@contrast/contrast 1.0.4 → 1.0.7

package/dist/scan/scanResults.js

@@ -4,6 +4,7 @@ const requestUtils = require('../../src/utils/requestUtils');
 const oraFunctions = require('../utils/oraWrapper');
 const _ = require('lodash');
 const i18n = require('i18n');
+const oraWrapper = require('../utils/oraWrapper');
 const getScanId = async (config, codeArtifactId, client) => {
     return client
         .getScanId(config, codeArtifactId)
@@ -25,9 +26,13 @@ const pollScanResults = async (config, scanId, client) => {
         console.log(err);
     });
 };
-const returnScanResults = async (config, codeArtifactId, timeout, startScanSpinner) => {
+const returnScanResults = async (config, codeArtifactId, newProject, timeout, startScanSpinner) => {
     const client = commonApi.getHttpClient(config);
     let scanId = await getScanId(config, codeArtifactId, client);
+    if (process.env.CODESEC_INVOCATION_ENVIRONMENT &&
+        process.env.CODESEC_INVOCATION_ENVIRONMENT.toUpperCase() === 'GITHUB') {
+        await client.createNewEvent(config, scanId, newProject);
+    }
     let startTime = new Date();
     let complete = false;
     if (!_.isNil(scanId)) {
@@ -40,12 +45,16 @@ const returnScanResults = async (config, codeArtifactId, timeout, startScanSpinn
                 }
                 if (result.body.status === 'FAILED') {
                     complete = true;
-                    oraFunctions.failSpinner(startScanSpinner, 'Contrast Scan Failed.');
-                    console.log(result.body.errorMessage);
-                    if (result.body.errorMessage ===
+                    if (config.debug) {
+                        oraFunctions.failSpinner(startScanSpinner, i18n.__('scanNotCompleted', 'https://docs.contrastsecurity.com/en/binary-package-preparation.html'));
+                    }
+                    if (result?.body?.errorMessage ===
                         'Unable to determine language for code artifact') {
+                        console.log(result.body.errorMessage);
                         console.log('Try scanning again using --language param. ', i18n.__('scanOptionsLanguageSummary'));
                     }
+                    oraWrapper.stopSpinner(startScanSpinner);
+                    console.log('Contrast Scan Finished');
                     process.exit(1);
                 }
             }
@@ -64,30 +73,21 @@ const returnScanResultsInstances = async (config, scanId) => {
     try {
         result = await client.getScanResultsInstances(config, scanId);
         if (JSON.stringify(result.statusCode) == 200) {
-            return result.body;
+            return { body: result.body, statusCode: result.statusCode };
         }
-    }
-    catch (e) {
-        console.log(e.message.toString());
-    }
-};
-const returnScanProjectById = async (config) => {
-    const client = commonApi.getHttpClient(config);
-    let result;
-    try {
-        result = await client.getScanProjectById(config);
-        if (JSON.stringify(result.statusCode) == 200) {
-            return result.body;
+        if (JSON.stringify(result.statusCode) == 503) {
+            return { statusCode: result.statusCode };
         }
     }
     catch (e) {
-        console.log(e.message.toString());
+        if (config.debug) {
+            console.log(e.message.toString());
+        }
     }
 };
 module.exports = {
     getScanId: getScanId,
     returnScanResults: returnScanResults,
     pollScanResults: pollScanResults,
-    returnScanResultsInstances: returnScanResultsInstances,
-    returnScanProjectById: returnScanProjectById
+    returnScanResultsInstances: returnScanResultsInstances
 };

package/dist/utils/commonApi.js

@@ -1,6 +1,6 @@
 "use strict";
 const HttpClient = require('./../common/HTTPClient');
-const { badRequestError, unauthenticatedError, forbiddenError, proxyError, genericError } = require('../common/errorHandling');
+const { badRequestError, unauthenticatedError, forbiddenError, proxyError, genericError, maxAppError } = require('../common/errorHandling');
 const handleResponseErrors = (res, api) => {
     if (res.statusCode === 400) {
         api === 'catalogue' ? badRequestError(true) : badRequestError(false);
@@ -14,6 +14,9 @@ const handleResponseErrors = (res, api) => {
     else if (res.statusCode === 407) {
         proxyError();
     }
+    else if (res.statusCode === 412) {
+        maxAppError();
+    }
     else {
         genericError();
     }

package/dist/utils/oraWrapper.js

@@ -6,6 +6,9 @@ const returnOra = text => {
 const startSpinner = spinner => {
     spinner.start();
 };
+const stopSpinner = spinner => {
+    spinner.stop();
+};
 const succeedSpinner = (spinner, text) => {
     spinner.succeed(text);
 };
@@ -16,5 +19,6 @@ module.exports = {
     returnOra,
     startSpinner,
     succeedSpinner,
-    failSpinner
+    failSpinner,
+    stopSpinner
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/contrast",
-  "version": "1.0.4",
+  "version": "1.0.7",
   "description": "Contrast Security's command line tool",
   "main": "dist/index.js",
   "bin": {
@@ -24,8 +24,8 @@
     "test-int": "jest ./test-integration/",
     "test-int-scan": "jest ./test-integration/scan",
     "test-int-audit": "jest ./test-integration/audit",
-    "format": "prettier --write \"**/*.{ts,tsx,js,css,scss,json,md,yml}\" .eslintrc.* .babelrc",
-    "check-format": "prettier --check \"**/*.{ts,tsx,js,css,scss,json,md,yml}\" .eslintrc.* .babelrc",
+    "format": "prettier --write \"**/*.{ts,tsx,js,json,md,yml}\" .eslintrc.*",
+    "check-format": "prettier --check \"**/*.{ts,tsx,js,json,md,yml}\" .eslintrc.*",
     "coverage-local": "nyc --reporter=text mocha './test/**/*.spec.js'",
     "coverage": "yarn test --coverage",
     "lint": "eslint --config .eslintrc.json . --ext .ts",
@@ -45,6 +45,7 @@
     "bluebird": "^3.7.2",
     "boxen": "5.1.2",
     "chalk": "4.1.2",
+    "cli-table3": "^0.6.2",
     "command-line-args": "^5.2.1",
     "command-line-usage": "^6.1.3",
     "conf": "^10.1.2",
@@ -73,12 +74,13 @@
     "@types/i18n": "^0.13.2",
     "@types/jest": "^27.4.1",
     "@types/lodash": "^4.14.182",
+    "@types/node": "*",
     "@typescript-eslint/eslint-plugin": "^5.21.0",
     "@typescript-eslint/parser": "^5.21.0",
     "csv-writer": "^1.6.0",
     "eslint": "^8.14.0",
     "eslint-config-prettier": "^8.5.0",
-    "eslint-plugin-prettier": "^4.0.0",
+    "eslint-plugin-prettier": "^4.2.1",
     "husky": "^3.1.0",
     "jest": "^27.5.1",
     "jest-junit": "^13.2.0",
@@ -86,7 +88,7 @@
     "npm-license-crawler": "^0.2.1",
     "nyc": "^15.1.0",
     "pkg": "^5.6.0",
-    "prettier": "^1.19.1",
+    "prettier": "^2.7.1",
     "tmp": "^0.2.1",
     "ts-jest": "^27.1.4",
     "ts-node": "^10.7.0",
@@ -102,12 +104,15 @@
   ],
   "prettier": {
     "semi": false,
+    "trailingComma": "none",
+    "arrowParens": "avoid",
+    "bracketSpacing": true,
     "singleQuote": true,
+    "bracketSameLine": true,
     "overrides": [
       {
         "files": [
-          ".eslintrc.ng",
-          ".babelrc"
+          ".eslintrc"
         ],
         "options": {
           "parser": "json"

package/src/audit/autodetection/autoDetectLanguage.ts

@@ -0,0 +1,40 @@
+/* eslint-disable  @typescript-eslint/no-explicit-any */
+import i18n from 'i18n'
+import {
+  reduceIdentifiedLanguages,
+  deduceLanguage
+} from '../languageAnalysisEngine/reduceIdentifiedLanguages'
+
+import { getProjectRootFilenames } from '../languageAnalysisEngine/getProjectRootFilenames'
+
+export function identifyLanguages(config: any) {
+  const { projectPath } = config
+  const projectRootFilenames = getProjectRootFilenames(projectPath)
+
+  const identifiedLanguages = projectRootFilenames.reduce(
+    (accumulator: any, filename: string) => {
+      const deducedLanguages = deduceLanguage(filename)
+      return [...accumulator, ...deducedLanguages]
+    },
+    []
+  )
+
+  if (Object.keys(identifiedLanguages).length === 0) {
+    throw new Error(i18n.__('languageAnalysisNoLanguage', projectPath))
+  }
+
+  return reduceIdentifiedLanguages(identifiedLanguages)
+}
+
+export function determineProjectLanguage(
+  reducedLanguages: Record<string, string>
+) {
+  const reducedLanguagesKeys = Object.keys(reducedLanguages)
+  if (reducedLanguagesKeys.length === 1) {
+    return reducedLanguagesKeys[0]
+  } else {
+    throw new Error(
+      'Detected multiple languages. Please specify a single language using --language'
+    )
+  }
+}

package/src/audit/catalogueApplication/catalogueApplication.js

@@ -1,21 +1,8 @@
 const i18n = require('i18n')
 const { getHttpClient, handleResponseErrors } = require('../../utils/commonApi')
 
-const locationOfApp = (config, appId) => {
-  return `${config.host}/Contrast/static/ng/index.html#/${config.organizationId}/applications/${appId}`
-}
-
-const displaySuccessMessage = (config, appId) => {
-  console.log(
-    '\n **************************' +
-      i18n.__('successHeader') +
-      '************************** \n'
-  )
-  console.log('\n' + i18n.__('catalogueSuccessCommand') + appId + '\n')
-  console.log(locationOfApp(config, appId))
-  console.log(
-    '\n *********************************************************** \n'
-  )
+const displaySuccessMessage = () => {
+  console.log(i18n.__('catalogueSuccessCommand'))
 }
 
 const catalogueApplication = async config => {
@@ -25,7 +12,7 @@ const catalogueApplication = async config => {
     .catalogueCommand(config)
     .then(res => {
       if (res.statusCode === 201) {
-        displaySuccessMessage(config, res.body.application.app_id)
+        //displaySuccessMessage(config, res.body.application.app_id)
         appId = res.body.application.app_id
       } else {
         handleResponseErrors(res, 'catalogue')

package/src/audit/javaAnalysisEngine/parseMavenProjectFileContents.js

@@ -34,12 +34,13 @@ const formatKeyName = value => {
   return tempArr[0] + '/' + tempArr[1] + '@' + tempArr[versionIndex]
 }
 
-const shaveConsoleOutputUntilItFindsFirsDigraphMention = mvnDependancyTreeOutput => {
-  //shaves of the console output until it reaches the first digraph
-  return mvnDependancyTreeOutput.substring(
-    mvnDependancyTreeOutput.indexOf('digraph')
-  )
-}
+const shaveConsoleOutputUntilItFindsFirsDigraphMention =
+  mvnDependancyTreeOutput => {
+    //shaves of the console output until it reaches the first digraph
+    return mvnDependancyTreeOutput.substring(
+      mvnDependancyTreeOutput.indexOf('digraph')
+    )
+  }
 
 const getDigraphObjInfo = editedOutput => {
   //turns the output into an array of digraph information
@@ -211,10 +212,12 @@ const parseMvn = mvnDependancyTreeOutput => {
 }
 
 // testing purposes
-exports.shaveConsoleOutputUntilItFindsFirsDigraphMention = shaveConsoleOutputUntilItFindsFirsDigraphMention
+exports.shaveConsoleOutputUntilItFindsFirsDigraphMention =
+  shaveConsoleOutputUntilItFindsFirsDigraphMention
 exports.getDigraphObjInfo = getDigraphObjInfo
 exports.createDigraphObjKey = createDigraphObjKey
-exports.turnDigraphDependanciesIntoArrOfInnerDep = turnDigraphDependanciesIntoArrOfInnerDep
+exports.turnDigraphDependanciesIntoArrOfInnerDep =
+  turnDigraphDependanciesIntoArrOfInnerDep
 exports.hasVersion = hasVersion
 exports.formatKeyName = formatKeyName
 exports.createOuterDependanciesAndType = createOuterDependanciesAndType

package/src/audit/languageAnalysisEngine/checkForMultipleIdentifiedLanguages.js

@@ -32,4 +32,5 @@ const checkForMultipleIdentifiedLanguages = identifiedLanguages => {
 }
 
 //For testing purposes
-exports.checkForMultipleIdentifiedLanguages = checkForMultipleIdentifiedLanguages
+exports.checkForMultipleIdentifiedLanguages =
+  checkForMultipleIdentifiedLanguages

package/src/audit/languageAnalysisEngine/checkForMultipleIdentifiedProjectFiles.js

@@ -38,4 +38,5 @@ const checkForMultipleIdentifiedProjectFiles = identifiedLanguages => {
 }
 
 //For testing purposes
-exports.checkForMultipleIdentifiedProjectFiles = checkForMultipleIdentifiedProjectFiles
+exports.checkForMultipleIdentifiedProjectFiles =
+  checkForMultipleIdentifiedProjectFiles

package/src/audit/languageAnalysisEngine/checkIdentifiedLanguageHasProjectFile.js

@@ -29,4 +29,5 @@ const checkIdentifiedLanguageHasProjectFile = identifiedLanguages => {
 }
 
 //For testing purposes
-exports.checkIdentifiedLanguageHasProjectFile = checkIdentifiedLanguageHasProjectFile
+exports.checkIdentifiedLanguageHasProjectFile =
+  checkIdentifiedLanguageHasProjectFile

package/src/audit/languageAnalysisEngine/languageAnalysisFactory.js

@@ -15,6 +15,13 @@ const fs = require('fs')
 const chalk = require('chalk')
 const saveFile = require('../../commands/audit/saveFile').default
 const generateSbom = require('../../sbom/generateSbom').default
+const {
+  failSpinner,
+  returnOra,
+  startSpinner,
+  succeedSpinner
+} = require('../../utils/oraWrapper')
+const { pollForSnapshotCompletition } = require('./sendSnapshot')
 
 module.exports = exports = (err, analysis) => {
   const { identifiedLanguageInfo } = analysis.languageAnalysis
@@ -45,17 +52,22 @@ module.exports = exports = (err, analysis) => {
       return process.exit(5)
     }
 
-    console.log('\n **************CONTRAST OSS ANALYSIS BEGINS**************')
+    const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'))
+    startSpinner(reportSpinner)
     const snapshotResponse = await newSendSnapShot(analysis, catalogueAppId)
 
+    //poll for completion
+    const pollResult = await pollForSnapshotCompletition(
+      analysis.config,
+      snapshotResponse.id,
+      reportSpinner
+    )
+    succeedSpinner(reportSpinner, 'Contrast SCA analysis complete')
+
     await vulnerabilityReport(analysis, catalogueAppId, snapshotResponse.id)
 
     //should be moved to processAudit.ts once promises implemented
     await auditSave(config)
-
-    console.log(
-      '\n ***************CONTRAST OSS ANALYSIS COMPLETE************** \n'
-    )
   }
 
   if (identifiedLanguageInfo.language === DOTNET) {

package/src/audit/languageAnalysisEngine/reduceIdentifiedLanguages.js

@@ -28,6 +28,79 @@ const isRubyLockFilename = filename => filename === 'Gemfile.lock'
 const isPipfileLockLockFilename = filename => filename === 'Pipfile.lock'
 const isGoProjectFilename = filename => filename === 'go.mod'
 
+const deduceLanguageScaAnalysis = filenames => {
+  const deducedLanguages = []
+  let language = ''
+
+  filenames.forEach(filename => {
+    // Check for project filenames...
+    if (isJavaMavenProjectFilename(filename)) {
+      deducedLanguages.push(filename)
+      language = JAVA
+    }
+
+    if (isJavaGradleProjectFilename(filename)) {
+      deducedLanguages.push(filename)
+      language = JAVA
+    }
+
+    if (isNodeProjectFilename(filename)) {
+      deducedLanguages.push(filename)
+      language = NODE
+    }
+    //
+    // if (isDotNetProjectFilename(filename)) {
+    //   deducedLanguages.push({language: DOTNET, projectFilename: filename})
+    // }
+    //
+    if (isRubyProjectFilename(filename)) {
+      deducedLanguages.push(filename)
+      language = RUBY
+    }
+    //
+    if (isPythonProjectFilename(filename)) {
+      deducedLanguages.push(filename)
+      language = PYTHON
+    }
+    //
+    // if (isPhpProjectFilename(filename)) {
+    //   deducedLanguages.push({language: PHP, projectFilename: filename})
+    // }
+    //
+    // // Check for lock filenames...
+    // if (isDotNetLockFilename(filename)) {
+    //   deducedLanguages.push({language: DOTNET, lockFilename: filename})
+    // }
+    //
+    if (isNodeLockFilename(filename)) {
+      deducedLanguages.push(filename)
+      language = NODE
+    }
+    //
+    // if (isRubyLockFilename(filename)) {
+    //   deducedLanguages.push({language: RUBY, lockFilename: filename})
+    // }
+    //
+    // // this is pipfileLock rather than python lock as there can be different python locks
+    // if (isPipfileLockLockFilename(filename)) {
+    //   deducedLanguages.push({language: PYTHON, lockFilename: filename})
+    // }
+    //
+    // if (isPhpLockFilename(filename)) {
+    //   deducedLanguages.push({language: PHP, lockFilename: filename})
+    // }
+    //
+    // go does not have a lockfile, it should have a go.mod file containing the modules
+    if (isGoProjectFilename(filename)) {
+      deducedLanguages.push({ language: GO, projectFilename: filename })
+      language = GO
+    }
+  })
+  let identifiedLanguages = { [language]: deducedLanguages }
+
+  return identifiedLanguages
+}
+
 const deduceLanguage = filename => {
   const deducedLanguages = []
 
@@ -136,9 +209,8 @@ module.exports = exports = (analysis, next) => {
 
   let language = config.language
   if (language === undefined) {
-    languageAnalysis.identifiedLanguages = reduceIdentifiedLanguages(
-      identifiedLanguages
-    )
+    languageAnalysis.identifiedLanguages =
+      reduceIdentifiedLanguages(identifiedLanguages)
   } else {
     let refinedIdentifiedLanguages = []
     for (let x in identifiedLanguages) {
@@ -175,3 +247,4 @@ exports.isPhpProjectFilename = isPhpProjectFilename
 exports.isPhpLockFilename = isPhpLockFilename
 exports.deduceLanguage = deduceLanguage
 exports.reduceIdentifiedLanguages = reduceIdentifiedLanguages
+exports.deduceLanguageScaAnalysis = deduceLanguageScaAnalysis

package/src/audit/languageAnalysisEngine/report/commonReportingFunctions.ts

@@ -1,4 +1,3 @@
-import i18n from 'i18n'
 import { getHttpClient, handleResponseErrors } from '../../../utils/commonApi'
 import {
   ReportCompositeKey,
@@ -8,52 +7,42 @@ import {
 import { ReportSeverityModel } from './models/reportSeverityModel'
 import { orderBy } from 'lodash'
 import chalk from 'chalk'
-import { ReportLibraryModel } from './models/reportLibraryModel'
-import { findHighestSeverityCVE, findNameAndVersion } from './utils/reportUtils'
+import { ReportCVEModel, ReportLibraryModel } from './models/reportLibraryModel'
 import {
-  failSpinner,
-  returnOra,
-  startSpinner,
-  succeedSpinner
-} from '../../../utils/oraWrapper'
+  findCVESeveritiesAndOrderByHighestPriority,
+  findHighestSeverityCVE,
+  findNameAndVersion,
+  severityCountAllCVEs
+} from './utils/reportUtils'
+import { SeverityCountModel } from './models/severityCountModel'
+import {
+  ReportOutputBodyModel,
+  ReportOutputHeaderModel,
+  ReportOutputModel
+} from './models/reportOutputModel'
 
 export const createLibraryHeader = (
   id: string,
   numberOfVulnerableLibraries: number,
-  numberOfCves: number,
-  name: string
+  numberOfCves: number
 ) => {
-  name
-    ? console.log(`\n Application Name: ${name} | Application ID: ${id}`)
-    : console.log(` Application ID: ${id}`)
-
   numberOfVulnerableLibraries === 1
     ? console.log(
-        '\n **************************' +
-          ` Found 1 vulnerable library containing ${numberOfCves} CVE's` +
-          '************************** '
+        ` Found 1 vulnerable library containing ${numberOfCves} CVE's`
       )
     : console.log(
-        '\n **************************' +
-          ` Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVE's ` +
-          '************************** '
+        ` Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVE's `
       )
 }
 
 export const getReport = async (config: any, reportId: string) => {
   const client = getHttpClient(config)
-
-  const reportSpinner = returnOra(i18n.__('auditReportWaiting'))
-  reportSpinner.indent = 1
-  startSpinner(reportSpinner)
   return client
     .getReportById(config, reportId)
     .then((res: { statusCode: number; body: any }) => {
       if (res.statusCode === 200) {
-        succeedSpinner(reportSpinner, i18n.__('auditReportSuccessMessage'))
         return res.body
       } else {
-        failSpinner(reportSpinner, i18n.__('auditReportFail'))
         console.log('config-------------------')
         console.log(config)
         console.log('reportId----------------')
@@ -100,28 +89,121 @@ export const printFormattedOutput = (
     report.reportOutputList.push(newOutputModel)
   }
 
-  const orderedOutputList = orderBy(
+  const orderedOutputListLowestFirst = orderBy(
     report.reportOutputList,
-    reportListItem => reportListItem.compositeKey.highestSeverity.priority
+    reportListItem => reportListItem.compositeKey.highestSeverity.priority,
+    ['desc']
   )
 
-  for (const reportModel of orderedOutputList) {
-    const name = reportModel.compositeKey.libraryName
-    const version = reportModel.compositeKey.libraryVersion
-    const highestSeverity = reportModel.compositeKey.highestSeverity.severity
-
+  let contrastHeaderNumCounter = 0
+  for (const reportModel of orderedOutputListLowestFirst) {
+    contrastHeaderNumCounter++
+    const { libraryName, libraryVersion, highestSeverity } =
+      reportModel.compositeKey
     const numOfCVEs = reportModel.cveArray.length
 
-    const cveNames: string[] = []
+    const header = buildHeader(
+      highestSeverity,
+      contrastHeaderNumCounter,
+      libraryName,
+      libraryVersion,
+      numOfCVEs
+    )
 
-    reportModel.cveArray.forEach(cve => cveNames.push(cve.name as string))
+    const body = buildBody(reportModel.cveArray)
 
-    const boldHeader = chalk.bold(`${highestSeverity} | Vulnerable Library`)
-    const cvePluralised = numOfCVEs > 1 ? 'CVEs' : 'CVE'
+    const reportOutputModel = new ReportOutputModel(header, body)
     console.log(
-      `\n ${boldHeader} ${name} (${version}) has ${numOfCVEs} known ${cvePluralised}`
+      reportOutputModel.header.vulnMessage,
+      reportOutputModel.header.introducesMessage
+    )
+    console.log(reportOutputModel.body.issueMessage)
+    console.log(reportOutputModel.body.adviceMessage)
+  }
+}
+
+export function buildHeader(
+  highestSeverity: ReportSeverityModel,
+  contrastHeaderNum: number,
+  libraryName: string,
+  version: string,
+  numOfCVEs: number
+) {
+  const vulnerabilityPluralised =
+    numOfCVEs > 1 ? 'Vulnerabilities' : 'Vulnerability'
+  const formattedHeaderNum = buildFormattedHeaderNum(contrastHeaderNum)
+
+  const vulnMessage = chalk
+    .hex(highestSeverity.outputColour)
+    .bold(
+      `${formattedHeaderNum} - [${highestSeverity.severity}] ${libraryName}-${version}`
     )
-    console.log(` ${cveNames.join(', ')}`)
-    console.log(chalk.bold(' How to fix: Update to latest version'))
+
+  const introducesMessage = chalk.bold(
+    `introduces ${numOfCVEs} ${vulnerabilityPluralised}`
+  )
+
+  return new ReportOutputHeaderModel(vulnMessage, introducesMessage)
+}
+
+export function buildBody(cveArray: ReportCVEModel[]) {
+  const cveMessages: string[] = []
+
+  findCVESeveritiesAndOrderByHighestPriority(cveArray).forEach(
+    reportSeverityModel => {
+      // @ts-ignore
+      const { outputColour, severity, cveName } = reportSeverityModel
+
+      const severityShorthand = chalk
+        .hex(outputColour)
+        .bold(`[${severity.charAt(0).toUpperCase()}]`)
+
+      const builtMessage = `${severityShorthand} ${cveName}`
+      cveMessages.push(builtMessage)
+    }
+  )
+
+  const numAndSeverityType = getNumOfAndSeverityType(cveArray)
+
+  const issueMessage = ` ${chalk.bold(
+    'Issue'
+  )}  : ${numAndSeverityType} ${cveMessages.join(', ')}.`
+
+  const adviceMessage = ` ${chalk.bold('Advice')} : ${chalk.bold(
+    'Update to latest version'
+  )}.`
+
+  return new ReportOutputBodyModel(issueMessage, adviceMessage)
+}
+
+export function buildFormattedHeaderNum(contrastHeaderNum: number) {
+  let formattedHeaderNum
+
+  if (contrastHeaderNum < 10) {
+    formattedHeaderNum = `00${contrastHeaderNum}`
+  } else if (contrastHeaderNum >= 10 && contrastHeaderNum < 100) {
+    formattedHeaderNum = `0${contrastHeaderNum}`
+  } else if (contrastHeaderNum >= 100) {
+    formattedHeaderNum = contrastHeaderNum
   }
+
+  return `CONTRAST-${formattedHeaderNum}`
+}
+
+export function getNumOfAndSeverityType(cveArray: ReportCVEModel[]) {
+  const { critical, high, medium, low, note } = severityCountAllCVEs(
+    cveArray,
+    new SeverityCountModel()
+  )
+
+  const criticalMessage = critical > 0 ? `${critical} Critical` : ''
+  const highMessage = high > 0 ? `${high} High` : ''
+  const mediumMessage = medium > 0 ? `${medium} Medium` : ''
+  const lowMessage = low > 0 ? `${low} Low` : ''
+  const noteMessage = note > 0 ? `${note} Note` : ''
+
+  //removes/trims whitespace to single spaces
+  return `${criticalMessage} ${highMessage} ${mediumMessage} ${lowMessage} ${noteMessage}`
+    .replace(/\s+/g, ' ')
+    .trim()
 }