@contrast/contrast 1.0.6 → 1.0.9

package/src/scan/autoDetection.js

@@ -1,6 +1,5 @@
 const i18n = require('i18n')
 const fileFinder = require('./fileUtils')
-const languageResolver = require('../audit/languageAnalysisEngine/reduceIdentifiedLanguages')
 const rootFile = require('../audit/languageAnalysisEngine/getProjectRootFilenames')
 
 const autoDetectFileAndLanguage = async configToUse => {
@@ -14,6 +13,11 @@ const autoDetectFileAndLanguage = async configToUse => {
       process.exit(1)
     }
 
+    if (fileFinder.fileIsEmpty(entries[0])) {
+      console.log(i18n.__('scanFileIsEmpty'))
+      process.exit(1)
+    }
+
     configToUse.file = entries[0]
     if (configToUse.name === undefined) {
       configToUse.name = entries[0]
@@ -23,39 +27,34 @@ const autoDetectFileAndLanguage = async configToUse => {
   }
 }
 
-const autoDetectAuditFilesAndLanguages = async () => {
+const autoDetectAuditFilesAndLanguages = async file => {
+  const filePath = file
   let languagesFound = []
-  console.log(i18n.__('searchingAuditFileDirectory', process.cwd()))
 
-  await fileFinder.findFilesJava(languagesFound)
-  await fileFinder.findFilesJavascript(languagesFound)
-  await fileFinder.findFilesPython(languagesFound)
-  await fileFinder.findFilesGo(languagesFound)
-  await fileFinder.findFilesPhp(languagesFound)
-  await fileFinder.findFilesRuby(languagesFound)
+  if (filePath) {
+    rootFile.getProjectRootFilenames(filePath)
+    console.log(i18n.__('searchingAuditFileDirectory', filePath))
+  } else {
+    console.log(i18n.__('searchingAuditFileDirectory', process.cwd()))
+  }
+
+  await fileFinder.findFilesJava(languagesFound, filePath)
+  await fileFinder.findFilesJavascript(languagesFound, filePath)
+  await fileFinder.findFilesPython(languagesFound, filePath)
+  await fileFinder.findFilesGo(languagesFound, filePath)
+  await fileFinder.findFilesPhp(languagesFound, filePath)
+  await fileFinder.findFilesRuby(languagesFound, filePath)
+  await fileFinder.findFilesDotNet(languagesFound, filePath)
 
-  if (languagesFound.length === 1) {
+  if (languagesFound.length <= 1) {
     return languagesFound
   } else {
     console.log(
-      'found multiple languages, please specify one using --file to run SCA analysis'
+      'found multiple languages, please specify one using --file to run SCA audit'
     )
   }
 }
 
-const manualDetectAuditFilesAndLanguages = async projectPath => {
-  let projectRootFilenames = await rootFile.getProjectRootFilenames(projectPath)
-  let identifiedLanguages = languageResolver.deduceLanguageScaAnalysis(
-    projectRootFilenames
-  )
-
-  if (Object.keys(identifiedLanguages).length === 0) {
-    console.log(i18n.__('languageAnalysisNoLanguage', projectPath))
-    return []
-  }
-  return [identifiedLanguages]
-}
-
 const hasWhiteSpace = s => {
   const filename = s.split('/').pop()
   return filename.indexOf(' ') >= 0
@@ -96,6 +95,5 @@ module.exports = {
   autoDetectFileAndLanguage,
   errorOnFileDetection,
   autoDetectAuditFilesAndLanguages,
-  errorOnAuditFileDetection,
-  manualDetectAuditFilesAndLanguages
+  errorOnAuditFileDetection
 }

package/src/scan/fileUtils.js

@@ -11,86 +11,106 @@ const findFile = async () => {
   })
 }
 
-const findFilesJava = async languagesFound => {
+const findFilesJava = async (languagesFound, filePath) => {
   const result = await fg(
     ['**/pom.xml', '**/build.gradle', '**/build.gradle.kts'],
     {
       dot: false,
       deep: 1,
-      onlyFiles: true
+      onlyFiles: true,
+      cwd: filePath ? filePath : process.cwd()
     }
   )
 
   if (result.length > 0) {
-    return languagesFound.push({ java: result })
+    return languagesFound.push({ JAVA: result })
   }
   return languagesFound
 }
 
-const findFilesJavascript = async languagesFound => {
+const findFilesJavascript = async (languagesFound, filePath) => {
   const result = await fg(
-    ['**/package.json', '**/yarn.lock', '**/package.lock.json'],
+    ['**/package.json', '**/yarn.lock', '**/package-lock.json'],
     {
       dot: false,
       deep: 1,
-      onlyFiles: true
+      onlyFiles: true,
+      cwd: filePath ? filePath : process.cwd()
     }
   )
 
   if (result.length > 0) {
-    return languagesFound.push({ javascript: result })
+    return languagesFound.push({ JAVASCRIPT: result })
   }
   return languagesFound
 }
 
-const findFilesPython = async languagesFound => {
+const findFilesPython = async (languagesFound, filePath) => {
   const result = await fg(['**/Pipfile.lock', '**/Pipfile'], {
     dot: false,
     deep: 3,
-    onlyFiles: true
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ python: result })
+    return languagesFound.push({ PYTHON: result })
   }
   return languagesFound
 }
 
-const findFilesGo = async languagesFound => {
+const findFilesGo = async (languagesFound, filePath) => {
   const result = await fg(['**/go.mod'], {
     dot: false,
     deep: 3,
-    onlyFiles: true
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ go: result })
+    return languagesFound.push({ GO: result })
   }
   return languagesFound
 }
 
-const findFilesRuby = async languagesFound => {
+const findFilesRuby = async (languagesFound, filePath) => {
   const result = await fg(['**/Gemfile', '**/Gemfile.lock'], {
     dot: false,
     deep: 3,
-    onlyFiles: true
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ ruby: result })
+    return languagesFound.push({ RUBY: result })
   }
   return languagesFound
 }
 
-const findFilesPhp = async languagesFound => {
+const findFilesPhp = async (languagesFound, filePath) => {
   const result = await fg(['**/composer.json', '**/composer.lock'], {
     dot: false,
     deep: 3,
-    onlyFiles: true
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ php: result })
+    return languagesFound.push({ PHP: result })
+  }
+  return languagesFound
+}
+
+const findFilesDotNet = async (languagesFound, filePath) => {
+  const result = await fg(['**/*.csproj', '**/packages.lock.json'], {
+    dot: false,
+    deep: 3,
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
+  })
+
+  if (result.length > 0) {
+    return languagesFound.push({ DOTNET: result })
   }
   return languagesFound
 }
@@ -110,6 +130,24 @@ const fileExists = path => {
   return fs.existsSync(path)
 }
 
+const fileIsEmpty = path => {
+  if (fileExists(path) && checkFilePermissions(path)) {
+    try {
+      return fs.readFileSync(path).length === 0
+    } catch (e) {
+      if (
+        e.message.toString().includes('illegal operation on a directory, read')
+      ) {
+        console.log('file provided cannot be a directory')
+      } else {
+        console.log(e.message.toString())
+      }
+      process.exit(0)
+    }
+  }
+  return false
+}
+
 module.exports = {
   findFile,
   fileExists,
@@ -119,5 +157,7 @@ module.exports = {
   findFilesPython,
   findFilesGo,
   findFilesPhp,
-  findFilesRuby
+  findFilesRuby,
+  findFilesDotNet,
+  fileIsEmpty
 }

package/src/scan/formatScanOutput.ts

@@ -1,5 +1,4 @@
 import {
-  ProjectOverview,
   ScanResultsInstances,
   ScanResultsModel
 } from './models/scanResultsModel'
@@ -20,7 +19,7 @@ import {
 export function formatScanOutput(scanResults: ScanResultsModel) {
   const { scanResultsInstances } = scanResults
 
-  let projectOverview = getProjectOverview(scanResultsInstances)
+  const projectOverview = getProjectOverview(scanResultsInstances)
   if (scanResultsInstances.content.length === 0) {
     console.log(i18n.__('scanNoVulnerabilitiesFound'))
     console.log(i18n.__('scanNoVulnerabilitiesFoundSecureCode'))
@@ -35,8 +34,9 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
 
     let defaultView = getDefaultView(scanResultsInstances.content)
 
-    let count = defaultView.length
+    let count = 0
     defaultView.forEach(entry => {
+      count++
       let table = new Table({
         chars: {
           top: '',
@@ -62,7 +62,7 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
       })
       let learnRow: string[] = []
       let adviceRow = []
-      let headerRow = [
+      const headerRow = [
         chalk
           .hex(entry.colour)
           .bold(`CONTRAST-${count.toString().padStart(3, '0')}`),
@@ -70,12 +70,15 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
         chalk.hex(entry.colour).bold(`[${entry.severity}] ${entry.ruleId}`) +
           entry.message
       ]
-      let codeRow = [
+
+      const codePath = entry.codePath?.replace(/^@/, '')
+
+      const codeRow = [
         chalk.hex('#F6F5F5').bold(`Code`),
         chalk.hex('#F6F5F5').bold(`:`),
-        chalk.hex('#F6F5F5').bold(`${entry.codePath}`)
+        chalk.hex('#F6F5F5').bold(`${codePath}`)
       ]
-      let issueRow = [chalk.bold(`Issue`), chalk.bold(`:`), `${entry.issue}`]
+      const issueRow = [chalk.bold(`Issue`), chalk.bold(`:`), `${entry.issue}`]
 
       table.push(headerRow, codeRow, issueRow)
 
@@ -96,7 +99,6 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
         ]
         table.push(learnRow)
       }
-      count--
       console.log(table.toString())
       console.log()
     })
@@ -123,7 +125,7 @@ function printVulnInfo(projectOverview: any) {
 }
 
 export function getProjectOverview(scanResultsInstances: ScanResultsInstances) {
-  let acc: any = {
+  const acc: any = {
     critical: 0,
     high: 0,
     medium: 0,
@@ -146,7 +148,7 @@ export function getProjectOverview(scanResultsInstances: ScanResultsInstances) {
 }
 
 export function formatLinks(objName: string, entry: any[]) {
-  let line = chalk.bold(objName + '  : ')
+  const line = chalk.bold(objName + '  : ')
   if (entry.length === 1) {
     console.log(line + chalk.hex('#97DCF7').bold.underline(entry[0]))
   } else {
@@ -177,7 +179,7 @@ export function getDefaultView(content: ResultContent[]) {
     assignBySeverity(resultEntry, groupResultsObj)
   })
 
-  return sortBy(groupTypeResults, ['priority']).reverse()
+  return sortBy(groupTypeResults, ['priority'])
 }
 export function editVulName(message: string) {
   return message.substring(message.indexOf(' in '))
@@ -216,10 +218,7 @@ export function getCodeFlowInfo(resultEntry: ResultContent) {
 }
 
 export function stripTags(oldString: string) {
-  return oldString
-    .replace(/\n/g, ' ')
-    .replace(/\s+/g, ' ')
-    .trim()
+  return oldString.replace(/\n/g, ' ').replace(/\s+/g, ' ').trim()
 }
 
 export function assignBySeverity(

package/src/scan/models/groupedResultsModel.ts

@@ -9,12 +9,12 @@ export class GroupedResultsModel {
   issue?: string
   priority?: number
   message?: string | undefined
-  colour: string;
-  codePath?: string;
+  colour: string
+  codePath?: string
 
   constructor(ruleId: string) {
     this.ruleId = ruleId
     this.colour = '#999999'
-    this.codePathSet = new Set<string>
+    this.codePathSet = new Set<string>()
   }
 }

package/src/scan/models/resultContentModel.ts

@@ -52,7 +52,7 @@ export interface CodeFlow {
 }
 
 export interface ResultContent {
-  message?: {text :string};
+  message?: { text: string }
   id: string
   organizationId: string
   projectId: string

package/src/scan/models/scanResultsModel.ts

@@ -4,11 +4,14 @@ export class ScanResultsModel {
   projectOverview: ProjectOverview
   scanDetail: ScanDetail
   scanResultsInstances: ScanResultsInstances
+  newProject: boolean
 
   constructor(scan: any) {
     this.projectOverview = scan.projectOverview as ProjectOverview
     this.scanDetail = scan.scanDetail as ScanDetail
-    this.scanResultsInstances = scan.scanResultsInstances as ScanResultsInstances
+    this.scanResultsInstances =
+      scan.scanResultsInstances as ScanResultsInstances
+    this.newProject = scan.newProject
   }
 }
 
@@ -49,4 +52,4 @@ export interface ScanDetail {
 
 export interface ScanResultsInstances {
   content: ResultContent[]
-}
+}

package/src/scan/populateProjectIdAndProjectName.js

@@ -8,9 +8,11 @@ const populateProjectId = async config => {
     proj = await getExistingProjectIdByName(config, client).then(res => {
       return res
     })
+
+    return { projectId: proj, isNewProject: false }
   }
 
-  return proj
+  return { projectId: proj, isNewProject: true }
 }
 
 const createProjectId = async (config, client) => {

package/src/scan/scan.ts

@@ -57,6 +57,7 @@ export const sendScan = async (config: any) => {
         }
       })
       .catch(err => {
+        oraWrapper.stopSpinner(startUploadSpinner)
         console.log(err)
       })
   }

package/src/scan/scanConfig.js

@@ -2,9 +2,7 @@ const paramHandler = require('../utils/paramsUtil/paramHandler')
 const constants = require('../../src/constants.js')
 const parsedCLIOptions = require('../../src/utils/parsedCLIOptions')
 const path = require('path')
-const {
-  supportedLanguages
-} = require('../audit/languageAnalysisEngine/constants')
+const { supportedLanguagesScan } = require('../constants/constants')
 const i18n = require('i18n')
 const { scanUsageGuide } = require('./help')
 
@@ -23,7 +21,7 @@ const getScanConfig = argv => {
 
   if (scanParams.language) {
     scanParams.language = scanParams.language.toUpperCase()
-    if (!Object.values(supportedLanguages).includes(scanParams.language)) {
+    if (!Object.values(supportedLanguagesScan).includes(scanParams.language)) {
       console.log(`Did not recognise --language ${scanParams.language}`)
       console.log(i18n.__('constantsHowToRunDev3'))
       process.exit(1)
@@ -31,11 +29,15 @@ const getScanConfig = argv => {
   }
 
   // if no name, take the full file path and use it as the project name
+  let projectNameSource
   if (!scanParams.name && scanParams.file) {
     scanParams.name = getFileName(scanParams.file)
+    projectNameSource = 'AUTO'
+  } else {
+    projectNameSource = 'USER'
   }
 
-  return { ...paramsAuth, ...scanParams }
+  return { ...paramsAuth, ...scanParams, projectNameSource }
 }
 
 const getFileName = file => {

package/src/scan/scanController.js

@@ -29,6 +29,11 @@ const fileAndLanguageLogic = async configToUse => {
       console.log(i18n.__('fileNotExist'))
       process.exit(1)
     }
+
+    if (fileFunctions.fileIsEmpty(configToUse.file)) {
+      console.log(i18n.__('scanFileIsEmpty'))
+      process.exit(1)
+    }
     return configToUse
   } else {
     if (configToUse.file === undefined || configToUse.file === null) {
@@ -41,10 +46,15 @@ const startScan = async configToUse => {
   const startTime = performance.now()
   await fileAndLanguageLogic(configToUse)
 
+  let newProject
+
   if (!configToUse.projectId) {
-    configToUse.projectId = await populateProjectIdAndProjectName.populateProjectId(
-      configToUse
-    )
+    const { projectId, isNewProject } =
+      await populateProjectIdAndProjectName.populateProjectId(configToUse)
+    configToUse.projectId = projectId
+    newProject = isNewProject
+  } else {
+    newProject = false
   }
   const codeArtifactId = await scan.sendScan(configToUse)
 
@@ -54,6 +64,7 @@ const startScan = async configToUse => {
     const scanDetail = await scanResults.returnScanResults(
       configToUse,
       codeArtifactId,
+      newProject,
       getTimeout(configToUse),
       startScanSpinner
     )
@@ -74,7 +85,10 @@ const startScan = async configToUse => {
       console.log(
         `----- Scan completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`
       )
-      return { scanDetail, scanResultsInstances: scanResultsInstances.body }
+      return {
+        scanDetail,
+        scanResultsInstances: scanResultsInstances.body
+      }
     }
   }
 }

package/src/scan/scanResults.js

@@ -31,11 +31,21 @@ const pollScanResults = async (config, scanId, client) => {
 const returnScanResults = async (
   config,
   codeArtifactId,
+  newProject,
   timeout,
   startScanSpinner
 ) => {
   const client = commonApi.getHttpClient(config)
   let scanId = await getScanId(config, codeArtifactId, client)
+
+  // send metrics event to sast-event-collector
+  if (
+    process.env.CODESEC_INVOCATION_ENVIRONMENT &&
+    process.env.CODESEC_INVOCATION_ENVIRONMENT.toUpperCase() === 'GITHUB'
+  ) {
+    await client.createNewEvent(config, scanId, newProject)
+  }
+
   let startTime = new Date()
   let complete = false
   if (!_.isNil(scanId)) {

package/src/utils/commonApi.js

@@ -4,7 +4,8 @@ const {
   unauthenticatedError,
   forbiddenError,
   proxyError,
-  genericError
+  genericError,
+  maxAppError
 } = require('../common/errorHandling')
 
 const handleResponseErrors = (res, api) => {
@@ -16,6 +17,8 @@ const handleResponseErrors = (res, api) => {
     forbiddenError()
   } else if (res.statusCode === 407) {
     proxyError()
+  } else if (res.statusCode === 412) {
+    maxAppError()
   } else {
     genericError()
   }

package/src/utils/filterProjectPath.js

@@ -1,4 +1,5 @@
 const path = require('path')
+const child_process = require('child_process')
 
 function resolveFilePath(filepath) {
   if (filepath[0] === '~') {
@@ -8,10 +9,13 @@ function resolveFilePath(filepath) {
 }
 
 const returnProjectPath = () => {
-  if (process.env.PWD !== (undefined || null || 'undefined')) {
+  if (process.platform == 'win32') {
+    let winPath = child_process.execSync('cd').toString()
+    return winPath.replace(/\//g, '\\').trim()
+  } else if (process.env.PWD !== (undefined || null || 'undefined')) {
     return process.env.PWD
   } else {
-    return process.argv[process.argv.indexOf('--project_path') + 1]
+    return process.argv[process.argv.indexOf('--file') + 1]
   }
 }
 

package/src/utils/getConfig.ts

@@ -33,11 +33,6 @@ const localConfig = (name: string, version: string) => {
   return config
 }
 
-const createConfigFromYaml = (yamlPath: string) => {
-  const yamlConfig = {}
-  return yamlConfig
-}
-
 const setConfigValues = (config: ContrastConf, values: ContrastConfOptions) => {
   config.set('apiKey', values.apiKey)
   config.set('organizationId', values.orgId)
@@ -45,10 +40,4 @@ const setConfigValues = (config: ContrastConf, values: ContrastConfOptions) => {
   values.host ? config.set('host', values.host) : null
 }
 
-export {
-  localConfig,
-  createConfigFromYaml,
-  setConfigValues,
-  ContrastConf,
-  ContrastConfOptions
-}
+export { localConfig, setConfigValues, ContrastConf, ContrastConfOptions }

package/dist/audit/AnalysisEngine.js

@@ -1,37 +0,0 @@
-"use strict";
-class AnalysisEngine {
-    constructor(initAnalysis = {}) {
-        this.analyzers = [];
-        this.analysis = { ...initAnalysis };
-    }
-    use(analyzer) {
-        if (Array.isArray(analyzer)) {
-            this.analyzers = [...this.analyzers, ...analyzer];
-            return;
-        }
-        this.analyzers.push(analyzer);
-    }
-    analyze(callback, config) {
-        let i = 0;
-        const next = err => {
-            if (err) {
-                return setImmediate(() => callback(err, this.analysis));
-            }
-            if (i >= this.analyzers.length) {
-                return setImmediate(() => callback(null, this.analysis));
-            }
-            const analyzer = this.analyzers[i];
-            i++;
-            setImmediate(() => {
-                try {
-                    analyzer(this.analysis, next, config);
-                }
-                catch (uncaughtErr) {
-                    next(uncaughtErr);
-                }
-            });
-        };
-        next();
-    }
-}
-module.exports = exports = AnalysisEngine;

package/dist/audit/autodetection/autoDetectLanguage.js

@@ -1,32 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.determineProjectLanguage = exports.identifyLanguages = void 0;
-const i18n_1 = __importDefault(require("i18n"));
-const reduceIdentifiedLanguages_1 = require("../languageAnalysisEngine/reduceIdentifiedLanguages");
-const getProjectRootFilenames_1 = require("../languageAnalysisEngine/getProjectRootFilenames");
-function identifyLanguages(config) {
-    const { projectPath } = config;
-    const projectRootFilenames = (0, getProjectRootFilenames_1.getProjectRootFilenames)(projectPath);
-    const identifiedLanguages = projectRootFilenames.reduce((accumulator, filename) => {
-        const deducedLanguages = (0, reduceIdentifiedLanguages_1.deduceLanguage)(filename);
-        return [...accumulator, ...deducedLanguages];
-    }, []);
-    if (Object.keys(identifiedLanguages).length === 0) {
-        throw new Error(i18n_1.default.__('languageAnalysisNoLanguage', projectPath));
-    }
-    return (0, reduceIdentifiedLanguages_1.reduceIdentifiedLanguages)(identifiedLanguages);
-}
-exports.identifyLanguages = identifyLanguages;
-function determineProjectLanguage(reducedLanguages) {
-    const reducedLanguagesKeys = Object.keys(reducedLanguages);
-    if (reducedLanguagesKeys.length === 1) {
-        return reducedLanguagesKeys[0];
-    }
-    else {
-        throw new Error('Detected multiple languages. Please specify a single language using --language');
-    }
-}
-exports.determineProjectLanguage = determineProjectLanguage;