@contrast/contrast 1.0.6 → 1.0.7

package/src/scaAnalysis/ruby/analysis.js

@@ -0,0 +1,282 @@
+const fs = require('fs')
+
+const readAndParseGemfile = projectPath => {
+  const fileName = filePathForWindows(projectPath + '/Gemfile')
+  const gemFile = fs.readFileSync(fileName, 'utf8')
+  const rubyArray = gemFile.split('\n')
+
+  let filteredRubyDep = rubyArray.filter(element => {
+    return (
+      !element.includes('#') &&
+      element.includes('gem') &&
+      !element.includes('source')
+    )
+  })
+
+  for (let i = 0; i < filteredRubyDep.length; i++) {
+    filteredRubyDep[i] = filteredRubyDep[i].trim()
+  }
+
+  return filteredRubyDep
+}
+
+const readAndParseGemLockFile = projectPath => {
+  const fileName = filePathForWindows(projectPath + '/Gemfile.lock')
+  const lockFile = fs.readFileSync(fileName, 'utf8')
+  const dependencyRegEx = /^\s*([A-Za-z0-9.!@#$%\-^&*_+]*)\s*(\((.*?)\))/
+
+  const lines = lockFile.split('\n')
+
+  return {
+    dependencies: getDirectDependencies(lines, dependencyRegEx),
+    runtimeDetails: getLockFileRuntimeInfo(lines),
+    sources: getSourceArray(lines, dependencyRegEx)
+  }
+}
+
+const nonDependencyKeys = (line, sourceObject) => {
+  const GEMFILE_KEY_VALUE = /^\s*([^:(]*)\s*\s*(.*)/
+  let parts = GEMFILE_KEY_VALUE.exec(line)
+  let key = parts[1].trim()
+  let value = parts[2] || ''
+
+  sourceObject[key] = value
+  return sourceObject
+}
+
+const populateResolveAndPlatform = (version, sourceObject) => {
+  const depArr = version.split('-')
+  sourceObject.resolved = depArr[0]
+  sourceObject.platform = depArr.length > 1 ? depArr[1] : 'UNSPECIFIED'
+  return sourceObject
+}
+
+const isUpperCase = str => {
+  return str === str.toUpperCase()
+}
+
+const getDirectDependencies = (lines, dependencyRegEx) => {
+  const dependencies = {}
+
+  let depIndex = 0
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i] === 'DEPENDENCIES') {
+      depIndex = i
+    }
+  }
+  const getDepArray = lines.slice(depIndex)
+
+  for (let j = 1; j < getDepArray.length; j++) {
+    const element = getDepArray[j]
+    if (!isUpperCase(element)) {
+      const isDependencyWithVersion = dependencyRegEx.test(element)
+      if (isDependencyWithVersion) {
+        const dependency = dependencyRegEx.exec(element)
+        let name = dependency[1]
+        name = name.replace('!', '')
+        dependencies[name.trim()] = dependency[3]
+      } else {
+        let name = element
+        name = name.replace('!', ' ')
+        dependencies[name.trim()] = 'UNSPECIFIED'
+      }
+    }
+  }
+
+  return dependencies
+}
+
+const getLockFileRuntimeInfo = lines => {
+  let rubVersionIndex = 0
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i] === 'RUBY VERSION') {
+      rubVersionIndex = i
+      break
+    }
+  }
+
+  const runtimeDetails = {}
+  if (rubVersionIndex !== 0) {
+    const getRubyVersionArray = lines.slice(rubVersionIndex)
+
+    for (let element of getRubyVersionArray) {
+      if (!isUpperCase(element)) {
+        runtimeDetails['version'] = getVersion(element)
+        runtimeDetails['patchLevel'] = getPatchLevel(element)
+
+        if (element.includes('engine')) {
+          let splitElement = element.split(' ')
+          runtimeDetails[splitElement[0]] = splitElement[1]
+        }
+      }
+    }
+  }
+  return runtimeDetails
+}
+
+const getVersion = element => {
+  const versionRegex = /^([ruby\s0-9.*]+)/
+  if (versionRegex.test(element)) {
+    let version = versionRegex.exec(element)[0]
+
+    if (version.includes('ruby')) {
+      return trimWhiteSpace(version.replace('ruby', ''))
+    }
+  }
+}
+
+const getPatchLevel = element => {
+  const patchLevelRegex = /(p\d+)/
+  if (patchLevelRegex.test(element)) {
+    return patchLevelRegex.exec(element)[0]
+  }
+}
+
+const formatSourceArr = sourceArr => {
+  return sourceArr.map(element => {
+    if (element.sourceType === 'GIT') {
+      delete element.specs
+    }
+
+    if (element.sourceType === 'GEM') {
+      delete element.branch
+      delete element.revision
+      delete element.depthLevel
+      delete element.specs
+    }
+
+    if (element.sourceType === 'PATH') {
+      delete element.branch
+      delete element.revision
+      delete element.depthLevel
+      delete element.specs
+      delete element.platform
+    }
+    return element
+  })
+}
+
+const getSourceArray = (lines, dependencyRegEx) => {
+  const sourceObject = {
+    dependencies: {}
+  }
+
+  const whitespaceRegx = /^(\s*)/
+  let index = 0
+
+  let line = 0
+  const sources = []
+  while ((line = lines[index++]) !== undefined) {
+    let currentWS = whitespaceRegx.exec(line)[1].length
+    if (!line.includes(' bundler (')) {
+      if (currentWS === 0 && !line.includes(':') && line !== '') {
+        sourceObject.sourceType = line
+      }
+
+      if (currentWS !== 0 && line.includes(':')) {
+        nonDependencyKeys(line, sourceObject)
+      }
+
+      if (currentWS > 2) {
+        let nexlineWS = whitespaceRegx.exec(lines[index])[1].length
+        sourceObject.dependencies = buildSourceDependencyWithVersion(
+          whitespaceRegx,
+          dependencyRegEx,
+          line,
+          currentWS,
+          sourceObject.name,
+          sourceObject.dependencies
+        )
+
+        if (currentWS === 4 && sourceObject.depthLevel === undefined) {
+          const dependency = dependencyRegEx.exec(line)
+          sourceObject.name = dependency[1]
+          sourceObject.depthLevel = currentWS
+          populateResolveAndPlatform(dependency[3], sourceObject)
+        }
+
+        if (currentWS === 4 && sourceObject.depthLevel) {
+          // create new Parent
+          const dependency = dependencyRegEx.exec(line)
+          sourceObject.name = dependency[1]
+          sourceObject.depthLevel = currentWS
+          populateResolveAndPlatform(dependency[3], sourceObject)
+        }
+
+        if (
+          (currentWS === 4 && nexlineWS === 4) ||
+          (currentWS === 6 && nexlineWS === 4) ||
+          nexlineWS === ''
+        ) {
+          let newObj = {}
+          newObj = JSON.parse(JSON.stringify(sourceObject))
+          sources.push(newObj)
+          sourceObject.dependencies = {}
+        }
+      }
+    }
+  }
+  return formatSourceArr(sources)
+}
+
+const buildSourceDependencyWithVersion = (
+  whitespaceRegx,
+  dependencyRegEx,
+  line,
+  currentWhiteSpace,
+  name,
+  dependencies
+) => {
+  const isDependencyWithVersion = dependencyRegEx.test(line)
+
+  if (currentWhiteSpace === 6) {
+    const dependency = dependencyRegEx.exec(line)
+    if (isDependencyWithVersion) {
+      if (name !== dependency[1]) {
+        dependencies[dependency[1]] = dependency[3]
+      }
+    } else {
+      dependencies[line.trim()] = 'UNSPECIFIED'
+    }
+  }
+
+  return dependencies
+}
+
+const getRubyDeps = config => {
+  try {
+    const parsedGem = readAndParseGemfile(config.projectPath)
+    const parsedLock = readAndParseGemLockFile(config.projectPath)
+
+    return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock }
+  } catch (err) {
+    console.log(err.message)
+    process.exit(1)
+  }
+}
+
+const trimWhiteSpace = string => {
+  return string.replace(/\s+/g, '')
+}
+
+const filePathForWindows = path => {
+  if (process.platform === 'win32') {
+    path = path.replace(/\//g, '\\')
+  }
+  return path
+}
+
+module.exports = {
+  getRubyDeps,
+  readAndParseGemfile,
+  readAndParseGemLockFile,
+  nonDependencyKeys,
+  populateResolveAndPlatform,
+  isUpperCase,
+  getDirectDependencies,
+  getLockFileRuntimeInfo,
+  getVersion,
+  getPatchLevel,
+  formatSourceArr,
+  getSourceArray
+}

package/src/scaAnalysis/ruby/index.js

@@ -0,0 +1,11 @@
+const { getRubyDeps } = require('./analysis')
+const { createRubyTSMessage } = require('../common/formatMessage')
+
+const rubyAnalysis = (config, languageFiles) => {
+  const rubyDeps = getRubyDeps(config, languageFiles.RUBY)
+  return createRubyTSMessage(rubyDeps)
+}
+
+module.exports = {
+  rubyAnalysis
+}

package/src/scan/autoDetection.js

@@ -14,6 +14,11 @@ const autoDetectFileAndLanguage = async configToUse => {
       process.exit(1)
     }
 
+    if (fileFinder.fileIsEmpty(entries[0])) {
+      console.log(i18n.__('scanFileIsEmpty'))
+      process.exit(1)
+    }
+
     configToUse.file = entries[0]
     if (configToUse.name === undefined) {
       configToUse.name = entries[0]
@@ -43,11 +48,10 @@ const autoDetectAuditFilesAndLanguages = async () => {
   }
 }
 
-const manualDetectAuditFilesAndLanguages = async projectPath => {
-  let projectRootFilenames = await rootFile.getProjectRootFilenames(projectPath)
-  let identifiedLanguages = languageResolver.deduceLanguageScaAnalysis(
-    projectRootFilenames
-  )
+const manualDetectAuditFilesAndLanguages = projectPath => {
+  let projectRootFilenames = rootFile.getProjectRootFilenames(projectPath)
+  let identifiedLanguages =
+    languageResolver.deduceLanguageScaAnalysis(projectRootFilenames)
 
   if (Object.keys(identifiedLanguages).length === 0) {
     console.log(i18n.__('languageAnalysisNoLanguage', projectPath))

package/src/scan/fileUtils.js

@@ -22,7 +22,7 @@ const findFilesJava = async languagesFound => {
   )
 
   if (result.length > 0) {
-    return languagesFound.push({ java: result })
+    return languagesFound.push({ JAVA: result })
   }
   return languagesFound
 }
@@ -38,7 +38,7 @@ const findFilesJavascript = async languagesFound => {
   )
 
   if (result.length > 0) {
-    return languagesFound.push({ javascript: result })
+    return languagesFound.push({ JAVASCRIPT: result })
   }
   return languagesFound
 }
@@ -51,7 +51,7 @@ const findFilesPython = async languagesFound => {
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ python: result })
+    return languagesFound.push({ PYTHON: result })
   }
   return languagesFound
 }
@@ -64,7 +64,7 @@ const findFilesGo = async languagesFound => {
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ go: result })
+    return languagesFound.push({ GO: result })
   }
   return languagesFound
 }
@@ -77,7 +77,7 @@ const findFilesRuby = async languagesFound => {
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ ruby: result })
+    return languagesFound.push({ RUBY: result })
   }
   return languagesFound
 }
@@ -90,7 +90,7 @@ const findFilesPhp = async languagesFound => {
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ php: result })
+    return languagesFound.push({ PHP: result })
   }
   return languagesFound
 }
@@ -110,6 +110,13 @@ const fileExists = path => {
   return fs.existsSync(path)
 }
 
+const fileIsEmpty = path => {
+  if (fileExists(path) && checkFilePermissions(path)) {
+    return fs.readFileSync(path).length === 0
+  }
+  return false
+}
+
 module.exports = {
   findFile,
   fileExists,
@@ -119,5 +126,6 @@ module.exports = {
   findFilesPython,
   findFilesGo,
   findFilesPhp,
-  findFilesRuby
+  findFilesRuby,
+  fileIsEmpty
 }

package/src/scan/formatScanOutput.ts

@@ -1,5 +1,4 @@
 import {
-  ProjectOverview,
   ScanResultsInstances,
   ScanResultsModel
 } from './models/scanResultsModel'
@@ -20,7 +19,7 @@ import {
 export function formatScanOutput(scanResults: ScanResultsModel) {
   const { scanResultsInstances } = scanResults
 
-  let projectOverview = getProjectOverview(scanResultsInstances)
+  const projectOverview = getProjectOverview(scanResultsInstances)
   if (scanResultsInstances.content.length === 0) {
     console.log(i18n.__('scanNoVulnerabilitiesFound'))
     console.log(i18n.__('scanNoVulnerabilitiesFoundSecureCode'))
@@ -62,7 +61,7 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
       })
       let learnRow: string[] = []
       let adviceRow = []
-      let headerRow = [
+      const headerRow = [
         chalk
           .hex(entry.colour)
           .bold(`CONTRAST-${count.toString().padStart(3, '0')}`),
@@ -70,12 +69,15 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
         chalk.hex(entry.colour).bold(`[${entry.severity}] ${entry.ruleId}`) +
           entry.message
       ]
-      let codeRow = [
+
+      const codePath = entry.codePath?.replace(/^@/, '')
+
+      const codeRow = [
         chalk.hex('#F6F5F5').bold(`Code`),
         chalk.hex('#F6F5F5').bold(`:`),
-        chalk.hex('#F6F5F5').bold(`${entry.codePath}`)
+        chalk.hex('#F6F5F5').bold(`${codePath}`)
       ]
-      let issueRow = [chalk.bold(`Issue`), chalk.bold(`:`), `${entry.issue}`]
+      const issueRow = [chalk.bold(`Issue`), chalk.bold(`:`), `${entry.issue}`]
 
       table.push(headerRow, codeRow, issueRow)
 
@@ -123,7 +125,7 @@ function printVulnInfo(projectOverview: any) {
 }
 
 export function getProjectOverview(scanResultsInstances: ScanResultsInstances) {
-  let acc: any = {
+  const acc: any = {
     critical: 0,
     high: 0,
     medium: 0,
@@ -146,7 +148,7 @@ export function getProjectOverview(scanResultsInstances: ScanResultsInstances) {
 }
 
 export function formatLinks(objName: string, entry: any[]) {
-  let line = chalk.bold(objName + '  : ')
+  const line = chalk.bold(objName + '  : ')
   if (entry.length === 1) {
     console.log(line + chalk.hex('#97DCF7').bold.underline(entry[0]))
   } else {
@@ -216,10 +218,7 @@ export function getCodeFlowInfo(resultEntry: ResultContent) {
 }
 
 export function stripTags(oldString: string) {
-  return oldString
-    .replace(/\n/g, ' ')
-    .replace(/\s+/g, ' ')
-    .trim()
+  return oldString.replace(/\n/g, ' ').replace(/\s+/g, ' ').trim()
 }
 
 export function assignBySeverity(

package/src/scan/models/groupedResultsModel.ts

@@ -9,12 +9,12 @@ export class GroupedResultsModel {
   issue?: string
   priority?: number
   message?: string | undefined
-  colour: string;
-  codePath?: string;
+  colour: string
+  codePath?: string
 
   constructor(ruleId: string) {
     this.ruleId = ruleId
     this.colour = '#999999'
-    this.codePathSet = new Set<string>
+    this.codePathSet = new Set<string>()
   }
 }

package/src/scan/models/resultContentModel.ts

@@ -52,7 +52,7 @@ export interface CodeFlow {
 }
 
 export interface ResultContent {
-  message?: {text :string};
+  message?: { text: string }
   id: string
   organizationId: string
   projectId: string

package/src/scan/models/scanResultsModel.ts

@@ -4,11 +4,14 @@ export class ScanResultsModel {
   projectOverview: ProjectOverview
   scanDetail: ScanDetail
   scanResultsInstances: ScanResultsInstances
+  newProject: boolean
 
   constructor(scan: any) {
     this.projectOverview = scan.projectOverview as ProjectOverview
     this.scanDetail = scan.scanDetail as ScanDetail
-    this.scanResultsInstances = scan.scanResultsInstances as ScanResultsInstances
+    this.scanResultsInstances =
+      scan.scanResultsInstances as ScanResultsInstances
+    this.newProject = scan.newProject
   }
 }
 
@@ -49,4 +52,4 @@ export interface ScanDetail {
 
 export interface ScanResultsInstances {
   content: ResultContent[]
-}
+}

package/src/scan/populateProjectIdAndProjectName.js

@@ -8,9 +8,11 @@ const populateProjectId = async config => {
     proj = await getExistingProjectIdByName(config, client).then(res => {
       return res
     })
+
+    return { projectId: proj, isNewProject: false }
   }
 
-  return proj
+  return { projectId: proj, isNewProject: true }
 }
 
 const createProjectId = async (config, client) => {

package/src/scan/scan.ts

@@ -57,6 +57,7 @@ export const sendScan = async (config: any) => {
         }
       })
       .catch(err => {
+        oraWrapper.stopSpinner(startUploadSpinner)
         console.log(err)
       })
   }

package/src/scan/scanConfig.js

@@ -31,11 +31,15 @@ const getScanConfig = argv => {
   }
 
   // if no name, take the full file path and use it as the project name
+  let projectNameSource
   if (!scanParams.name && scanParams.file) {
     scanParams.name = getFileName(scanParams.file)
+    projectNameSource = 'AUTO'
+  } else {
+    projectNameSource = 'USER'
   }
 
-  return { ...paramsAuth, ...scanParams }
+  return { ...paramsAuth, ...scanParams, projectNameSource }
 }
 
 const getFileName = file => {

package/src/scan/scanController.js

@@ -29,6 +29,11 @@ const fileAndLanguageLogic = async configToUse => {
       console.log(i18n.__('fileNotExist'))
       process.exit(1)
     }
+
+    if (fileFunctions.fileIsEmpty(configToUse.file)) {
+      console.log(i18n.__('scanFileIsEmpty'))
+      process.exit(1)
+    }
     return configToUse
   } else {
     if (configToUse.file === undefined || configToUse.file === null) {
@@ -41,10 +46,15 @@ const startScan = async configToUse => {
   const startTime = performance.now()
   await fileAndLanguageLogic(configToUse)
 
+  let newProject
+
   if (!configToUse.projectId) {
-    configToUse.projectId = await populateProjectIdAndProjectName.populateProjectId(
-      configToUse
-    )
+    const { projectId, isNewProject } =
+      await populateProjectIdAndProjectName.populateProjectId(configToUse)
+    configToUse.projectId = projectId
+    newProject = isNewProject
+  } else {
+    newProject = false
   }
   const codeArtifactId = await scan.sendScan(configToUse)
 
@@ -54,6 +64,7 @@ const startScan = async configToUse => {
     const scanDetail = await scanResults.returnScanResults(
       configToUse,
       codeArtifactId,
+      newProject,
       getTimeout(configToUse),
       startScanSpinner
     )
@@ -74,7 +85,10 @@ const startScan = async configToUse => {
       console.log(
         `----- Scan completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`
       )
-      return { scanDetail, scanResultsInstances: scanResultsInstances.body }
+      return {
+        scanDetail,
+        scanResultsInstances: scanResultsInstances.body
+      }
     }
   }
 }

package/src/scan/scanResults.js

@@ -31,11 +31,21 @@ const pollScanResults = async (config, scanId, client) => {
 const returnScanResults = async (
   config,
   codeArtifactId,
+  newProject,
   timeout,
   startScanSpinner
 ) => {
   const client = commonApi.getHttpClient(config)
   let scanId = await getScanId(config, codeArtifactId, client)
+
+  // send metrics event to sast-event-collector
+  if (
+    process.env.CODESEC_INVOCATION_ENVIRONMENT &&
+    process.env.CODESEC_INVOCATION_ENVIRONMENT.toUpperCase() === 'GITHUB'
+  ) {
+    await client.createNewEvent(config, scanId, newProject)
+  }
+
   let startTime = new Date()
   let complete = false
   if (!_.isNil(scanId)) {

package/src/utils/commonApi.js

@@ -4,7 +4,8 @@ const {
   unauthenticatedError,
   forbiddenError,
   proxyError,
-  genericError
+  genericError,
+  maxAppError
 } = require('../common/errorHandling')
 
 const handleResponseErrors = (res, api) => {
@@ -16,6 +17,8 @@ const handleResponseErrors = (res, api) => {
     forbiddenError()
   } else if (res.statusCode === 407) {
     proxyError()
+  } else if (res.statusCode === 412) {
+    maxAppError()
   } else {
     genericError()
   }