@contrast/contrast 1.0.6 → 1.0.9

package/src/audit/languageAnalysisEngine/report/commonReportingFunctions.ts

@@ -9,29 +9,35 @@ import { orderBy } from 'lodash'
 import chalk from 'chalk'
 import { ReportCVEModel, ReportLibraryModel } from './models/reportLibraryModel'
 import {
+  countVulnerableLibrariesBySeverity,
   findCVESeveritiesAndOrderByHighestPriority,
   findHighestSeverityCVE,
   findNameAndVersion,
   severityCountAllCVEs
 } from './utils/reportUtils'
-import {SeverityCountModel} from "./models/severityCountModel";
+import { SeverityCountModel } from './models/severityCountModel'
 import {
   ReportOutputBodyModel,
   ReportOutputHeaderModel,
   ReportOutputModel
-} from "./models/reportOutputModel";
+} from './models/reportOutputModel'
+import {
+  CRITICAL_COLOUR,
+  HIGH_COLOUR,
+  LOW_COLOUR,
+  MEDIUM_COLOUR,
+  NOTE_COLOUR
+} from '../../../constants/constants'
+import Table from 'cli-table3'
 
-export const createLibraryHeader = (
-  id: string,
+export const createSummaryMessage = (
   numberOfVulnerableLibraries: number,
   numberOfCves: number
 ) => {
   numberOfVulnerableLibraries === 1
-    ? console.log(
-        ` Found 1 vulnerable library containing ${numberOfCves} CVE's`
-      )
+    ? console.log(`Found 1 vulnerable library containing ${numberOfCves} CVE`)
     : console.log(
-        ` Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVE's `
+        `Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVEs`
       )
 }
 
@@ -43,10 +49,6 @@ export const getReport = async (config: any, reportId: string) => {
       if (res.statusCode === 200) {
         return res.body
       } else {
-        console.log('config-------------------')
-        console.log(config)
-        console.log('reportId----------------')
-        console.log(reportId)
         console.log(JSON.stringify(res))
         handleResponseErrors(res, 'report')
       }
@@ -57,21 +59,35 @@ export const getReport = async (config: any, reportId: string) => {
 }
 
 export const printVulnerabilityResponse = (
-  vulnerabilities: ReportLibraryModel[],
-  config: any
+  config: any,
+  vulnerableLibraries: ReportLibraryModel[],
+  numberOfVulnerableLibraries: number,
+  numberOfCves: number,
+  guidance: any
 ) => {
   let hasSomeVulnerabilitiesReported = false
-  printFormattedOutput(vulnerabilities, config)
-  if (Object.keys(vulnerabilities).length > 0) {
+  printFormattedOutput(
+    config,
+    vulnerableLibraries,
+    numberOfVulnerableLibraries,
+    numberOfCves,
+    guidance
+  )
+  if (Object.keys(vulnerableLibraries).length > 0) {
     hasSomeVulnerabilitiesReported = true
   }
   return hasSomeVulnerabilitiesReported
 }
 
 export const printFormattedOutput = (
+  config: any,
   libraries: ReportLibraryModel[],
-  config: any
+  numberOfVulnerableLibraries: number,
+  numberOfCves: number,
+  guidance: any
 ) => {
+  createSummaryMessage(numberOfVulnerableLibraries, numberOfCves)
+  console.log()
   const report = new ReportList()
 
   for (const library of libraries) {
@@ -81,26 +97,61 @@ export const printFormattedOutput = (
       new ReportCompositeKey(
         name,
         version,
-        findHighestSeverityCVE(library.cveArray) as ReportSeverityModel
+        findHighestSeverityCVE(library.cveArray) as ReportSeverityModel,
+        severityCountAllCVEs(
+          library.cveArray,
+          new SeverityCountModel()
+        ).getTotal
       ),
       library.cveArray
     )
-
     report.reportOutputList.push(newOutputModel)
   }
 
-  const orderedOutputListLowestFirst = orderBy(
+  const outputOrderedByLowestSeverityAndLowestNumOfCvesFirst = orderBy(
     report.reportOutputList,
-    reportListItem => reportListItem.compositeKey.highestSeverity.priority,
-    ['desc']
+    [
+      (reportListItem: ReportModelStructure) => {
+        return reportListItem.compositeKey.highestSeverity.priority
+      },
+      (reportListItem: ReportModelStructure) => {
+        return reportListItem.compositeKey.numberOfSeverities
+      }
+    ],
+    ['asc', 'desc']
   )
 
   let contrastHeaderNumCounter = 0
-  for (const reportModel of orderedOutputListLowestFirst) {
+  for (const reportModel of outputOrderedByLowestSeverityAndLowestNumOfCvesFirst) {
     contrastHeaderNumCounter++
-    const {libraryName, libraryVersion, highestSeverity} = reportModel.compositeKey
+    const { libraryName, libraryVersion, highestSeverity } =
+      reportModel.compositeKey
     const numOfCVEs = reportModel.cveArray.length
 
+    const table = new Table({
+      chars: {
+        top: '',
+        'top-mid': '',
+        'top-left': '',
+        'top-right': '',
+        bottom: '',
+        'bottom-mid': '',
+        'bottom-left': '',
+        'bottom-right': '',
+        left: '',
+        'left-mid': '',
+        mid: '',
+        'mid-mid': '',
+        right: '',
+        'right-mid': '',
+        middle: ' '
+      },
+      style: { 'padding-left': 0, 'padding-right': 0 },
+      colAligns: ['right'],
+      wordWrap: true,
+      colWidths: [12, 1, 100]
+    })
+
     const header = buildHeader(
       highestSeverity,
       contrastHeaderNumCounter,
@@ -109,15 +160,36 @@ export const printFormattedOutput = (
       numOfCVEs
     )
 
-    const body = buildBody(
-      reportModel.cveArray
-    )
+    const advice = gatherRemediationAdvice(guidance, reportModel)
+
+    const body = buildBody(reportModel.cveArray, advice)
 
     const reportOutputModel = new ReportOutputModel(header, body)
-    console.log(reportOutputModel.header.vulnMessage, reportOutputModel.header.introducesMessage)
-    console.log(reportOutputModel.body.issueMessage)
-    console.log(reportOutputModel.body.adviceMessage)
+
+    table.push(
+      reportOutputModel.body.issueMessage,
+      reportOutputModel.body.issueMessageCves,
+      reportOutputModel.body.adviceMessage
+    )
+
+    console.log(
+      reportOutputModel.header.vulnMessage,
+      reportOutputModel.header.introducesMessage
+    )
+    console.log(table.toString() + '\n')
   }
+
+  createSummaryMessage(numberOfVulnerableLibraries, numberOfCves)
+  const {
+    criticalMessage,
+    highMessage,
+    mediumMessage,
+    lowMessage,
+    noteMessage
+  } = buildFooter(outputOrderedByLowestSeverityAndLowestNumOfCvesFirst)
+  console.log(
+    `${criticalMessage} | ${highMessage} | ${mediumMessage} | ${lowMessage} | ${noteMessage}`
+  )
 }
 
 export function buildHeader(
@@ -125,71 +197,93 @@ export function buildHeader(
   contrastHeaderNum: number,
   libraryName: string,
   version: string,
-  numOfCVEs: number,
+  numOfCVEs: number
 ) {
-  const vulnerabilityPluralised = numOfCVEs > 1 ? 'Vulnerabilities' : 'Vulnerability'
+  const vulnerabilityPluralised =
+    numOfCVEs > 1 ? 'vulnerabilities' : 'vulnerability'
   const formattedHeaderNum = buildFormattedHeaderNum(contrastHeaderNum)
 
   const vulnMessage = chalk
-  .hex(highestSeverity.outputColour)
-  .bold(`${formattedHeaderNum} - [${highestSeverity.severity}] ${libraryName}-${version}`)
+    .hex(highestSeverity.outputColour)
+    .bold(
+      `${formattedHeaderNum} - [${highestSeverity.severity}] ${libraryName}-${version}`
+    )
 
-  const introducesMessage = chalk.bold(
-    `introduces ${numOfCVEs} ${vulnerabilityPluralised}`
-  )
+  const introducesMessage = `introduces ${numOfCVEs} ${vulnerabilityPluralised}`
 
   return new ReportOutputHeaderModel(vulnMessage, introducesMessage)
 }
 
-export function buildBody(cveArray: ReportCVEModel[]) {
+export function buildBody(cveArray: ReportCVEModel[], advice: any) {
   const cveMessages: string[] = []
 
-  findCVESeveritiesAndOrderByHighestPriority(cveArray).forEach(reportSeverityModel => {
+  findCVESeveritiesAndOrderByHighestPriority(cveArray).forEach(
+    reportSeverityModel => {
       // @ts-ignore
-      const {outputColour, severity, cveName} = reportSeverityModel
+      const { outputColour, severity, cveName } = reportSeverityModel
 
       const severityShorthand = chalk
-      .hex(outputColour)
-      .bold(`[${severity.charAt(0).toUpperCase()}]`)
+        .hex(outputColour)
+        .bold(`[${severity.charAt(0).toUpperCase()}]`)
 
-      const builtMessage = `${severityShorthand} ${cveName}`
+      const builtMessage = severityShorthand + cveName
       cveMessages.push(builtMessage)
     }
   )
 
   const numAndSeverityType = getNumOfAndSeverityType(cveArray)
 
-  const issueMessage =
-    ` ${chalk.bold('Issue')}  : ${numAndSeverityType} ${cveMessages.join(', ')}.`
+  const issueMessage = [chalk.bold('Issue'), ':', `${numAndSeverityType}`]
 
-  const adviceMessage =
-    ` ${chalk.bold('Advice')} : ${chalk.bold('Update to latest version')}.`
+  const issueMessageCves = ['', '', cveMessages.join(', ')]
 
-  return new ReportOutputBodyModel(issueMessage, adviceMessage)
+  //todo different advice based on remediationGuidance being available or now
+  // console.log(advice)
+
+  const displayAdvice = advice?.minimum
+    ? `Update to version ${chalk.bold(advice.minimum)}`
+    : `Update to latest version`
+
+  const adviceMessage = [chalk.bold('Advice'), ':', displayAdvice]
+
+  return new ReportOutputBodyModel(
+    issueMessage,
+    issueMessageCves,
+    adviceMessage
+  )
 }
 
-export function buildFormattedHeaderNum(contrastHeaderNum: number) {
-  let formattedHeaderNum
-
-  if (contrastHeaderNum < 10) {
-    formattedHeaderNum = `00${contrastHeaderNum}`
-  } else if (contrastHeaderNum >= 10 && contrastHeaderNum < 100) {
-    formattedHeaderNum = `0${contrastHeaderNum}`
-  } else if (contrastHeaderNum >= 100) {
-    formattedHeaderNum = contrastHeaderNum
+export function gatherRemediationAdvice(guidance: any, reportModel: any) {
+  const guidanceData = {
+    minimum: undefined,
+    maximum: undefined,
+    latest: undefined
   }
 
-  return `CONTRAST-${formattedHeaderNum}`
+  const data =
+    guidance[
+      reportModel.compositeKey.libraryName +
+        '@' +
+        reportModel.compositeKey.libraryVersion
+    ]
+
+  if (data) {
+    guidanceData.minimum = data.minUpgradeVersion
+    guidanceData.maximum = data.maxUpgradeVersion
+  }
+
+  return guidanceData
+}
+
+export function buildFormattedHeaderNum(contrastHeaderNum: number) {
+  return `CONTRAST-${contrastHeaderNum.toString().padStart(3, '0')}`
 }
 
 export function getNumOfAndSeverityType(cveArray: ReportCVEModel[]) {
-  const {
-    critical,
-    high,
-    medium,
-    low,
-    note
-  } = severityCountAllCVEs(cveArray, new SeverityCountModel())
+  const { critical, high, medium, low, note } = severityCountAllCVEs(
+    cveArray,
+    new SeverityCountModel()
+  )
 
   const criticalMessage = critical > 0 ? `${critical} Critical` : ''
   const highMessage = high > 0 ? `${high} High` : ''
@@ -199,6 +293,27 @@ export function getNumOfAndSeverityType(cveArray: ReportCVEModel[]) {
 
   //removes/trims whitespace to single spaces
   return `${criticalMessage} ${highMessage} ${mediumMessage} ${lowMessage} ${noteMessage}`
-  .replace(/\s+/g, ' ')
-  .trim();
-}
+    .replace(/\s+/g, ' ')
+    .trim()
+}
+
+const buildFooter = (reportModelStructure: ReportModelStructure[]) => {
+  const { critical, high, medium, low, note } =
+    countVulnerableLibrariesBySeverity(reportModelStructure)
+
+  const criticalMessage = chalk
+    .hex(CRITICAL_COLOUR)
+    .bold(`${critical} Critical`)
+  const highMessage = chalk.hex(HIGH_COLOUR).bold(`${high} High`)
+  const mediumMessage = chalk.hex(MEDIUM_COLOUR).bold(`${medium} Medium`)
+  const lowMessage = chalk.hex(LOW_COLOUR).bold(`${low} Low`)
+  const noteMessage = chalk.hex(NOTE_COLOUR).bold(`${note} Note`)
+
+  return {
+    criticalMessage,
+    highMessage,
+    mediumMessage,
+    lowMessage,
+    noteMessage
+  }
+}

package/src/audit/languageAnalysisEngine/report/models/reportLibraryModel.ts

@@ -2,7 +2,7 @@ export class ReportLibraryModel {
   name: string
   cveArray: ReportCVEModel[]
 
-  constructor (name: string, cveArray: ReportCVEModel[]){
+  constructor(name: string, cveArray: ReportCVEModel[]) {
     this.name = name
     this.cveArray = cveArray
   }
@@ -16,12 +16,12 @@ export class ReportCVEModel {
   severityCode?: string
   cvss3SeverityCode?: string
 
-  constructor (
+  constructor(
     name: string,
     description: string,
     severityCode: string,
     cvss3SeverityCode: string
-  ){
+  ) {
     this.name = name
     this.description = description
     this.severityCode = severityCode

package/src/audit/languageAnalysisEngine/report/models/reportListModel.ts

@@ -1,32 +1,39 @@
-import {ReportSeverityModel} from "./reportSeverityModel";
-import {ReportCVEModel} from "./reportLibraryModel";
+import { ReportSeverityModel } from './reportSeverityModel'
+import { ReportCVEModel } from './reportLibraryModel'
 
 export class ReportList {
   reportOutputList: ReportModelStructure[]
 
-  constructor (){
+  constructor() {
     this.reportOutputList = []
   }
 }
 
 export class ReportModelStructure {
-  compositeKey: ReportCompositeKey;
-  cveArray: ReportCVEModel[];
+  compositeKey: ReportCompositeKey
+  cveArray: ReportCVEModel[]
 
-  constructor (compositeKey: ReportCompositeKey, cveArray: ReportCVEModel[]){
+  constructor(compositeKey: ReportCompositeKey, cveArray: ReportCVEModel[]) {
     this.compositeKey = compositeKey
     this.cveArray = cveArray
   }
 }
 
 export class ReportCompositeKey {
-  libraryName!: string;
-  libraryVersion!: string;
-  highestSeverity!: ReportSeverityModel;
+  libraryName!: string
+  libraryVersion!: string
+  highestSeverity!: ReportSeverityModel
+  numberOfSeverities!: number
 
-  constructor (libraryName: string, libraryVersion: string, highestSeverity: ReportSeverityModel){
+  constructor(
+    libraryName: string,
+    libraryVersion: string,
+    highestSeverity: ReportSeverityModel,
+    numberOfSeverities: number
+  ) {
     this.libraryName = libraryName
     this.libraryVersion = libraryVersion
     this.highestSeverity = highestSeverity
+    this.numberOfSeverities = numberOfSeverities
   }
-}
+}

package/src/audit/languageAnalysisEngine/report/models/reportOutputModel.ts

@@ -19,11 +19,17 @@ export class ReportOutputHeaderModel {
 }
 
 export class ReportOutputBodyModel {
-  issueMessage: string
-  adviceMessage: string
+  issueMessage: string[]
+  issueMessageCves: string[]
+  adviceMessage: string[]
 
-  constructor(bodyIssueMessage: string, bodyAdviceMessage: string) {
-    this.issueMessage = bodyIssueMessage
-    this.adviceMessage = bodyAdviceMessage
+  constructor(
+    issueMessage: string[],
+    issueMessageCves: string[],
+    adviceMessage: string[]
+  ) {
+    this.issueMessage = issueMessage
+    this.issueMessageCves = issueMessageCves
+    this.adviceMessage = adviceMessage
   }
 }

package/src/audit/languageAnalysisEngine/report/models/reportSeverityModel.ts

@@ -4,7 +4,12 @@ export class ReportSeverityModel {
   outputColour: string
   cveName: string
 
-  constructor(severity: string, priority: number, outputColour: string, cveName: string) {
+  constructor(
+    severity: string,
+    priority: number,
+    outputColour: string,
+    cveName: string
+  ) {
     this.severity = severity
     this.priority = priority
     this.outputColour = outputColour

package/src/audit/languageAnalysisEngine/report/models/severityCountModel.ts

@@ -13,4 +13,8 @@ export class SeverityCountModel {
     this.low = 0
     this.note = 0
   }
+
+  get getTotal(): number {
+    return this.critical + this.high + this.medium + this.low + this.note
+  }
 }

package/src/audit/languageAnalysisEngine/report/reportingFeature.ts

@@ -1,56 +1,110 @@
 import {
-  createLibraryHeader,
   getReport,
   printVulnerabilityResponse
 } from './commonReportingFunctions'
 import {
-  convertGenericToTypedLibraries,
+  convertGenericToTypedLibraryVulns,
   severityCountAllLibraries
 } from './utils/reportUtils'
+import i18n from 'i18n'
+import chalk from 'chalk'
+import * as constants from '../../../constants/constants'
 
-export async function vulnerabilityReport(
-  analysis: any,
-  applicationId: string,
-  reportId: string
-) {
-  const reportResponse = await getReport(analysis.config, reportId)
+export function convertKeysToStandardFormat(config: any, guidance: any) {
+  let convertedGuidance = guidance
 
-  if (reportResponse !== undefined) {
-    const id = applicationId
-    const name = analysis.config.applicationName
-    formatVulnerabilityOutput(
-      reportResponse.vulnerabilities,
-      id,
-      name,
-      analysis.config
-    )
+  switch (config.language) {
+    case constants.supportedLanguages.JAVA:
+    case constants.supportedLanguages.GO:
+    case constants.supportedLanguages.PHP:
+      break
+    case constants.supportedLanguages.NODE:
+    case constants.supportedLanguages.DOTNET:
+    case constants.supportedLanguages.PYTHON:
+    case constants.supportedLanguages.RUBY:
+      convertedGuidance = convertJSDotNetPython(guidance)
+      break
   }
+  return convertedGuidance
+}
+
+export function convertJSDotNetPython(guidance: any) {
+  const returnObject = {}
+
+  Object.entries(guidance).forEach(([key, value]) => {
+    const splitKey = key.split('/')
+    if (splitKey.length === 2) {
+      // @ts-ignore
+      returnObject[splitKey[1]] = value
+    }
+  })
+  return returnObject
 }
 
 export function formatVulnerabilityOutput(
   libraryVulnerabilityResponse: any,
   id: string,
-  name: string,
-  config: any
+  config: any,
+  remediationGuidance: any
 ) {
-  const vulnerableLibraries = convertGenericToTypedLibraries(
+  const vulnerableLibraries = convertGenericToTypedLibraryVulns(
     libraryVulnerabilityResponse
   )
 
+  const guidance = convertKeysToStandardFormat(config, remediationGuidance)
+
   const numberOfVulnerableLibraries = vulnerableLibraries.length
-  let numberOfCves = 0
-  vulnerableLibraries.forEach(lib => (numberOfCves += lib.cveArray.length))
 
-  createLibraryHeader(id, numberOfVulnerableLibraries, numberOfCves)
+  if (numberOfVulnerableLibraries === 0) {
+    console.log(i18n.__('scanNoVulnerabilitiesFound'))
+    console.log(i18n.__('scanNoVulnerabilitiesFoundSecureCode'))
+    console.log(i18n.__('scanNoVulnerabilitiesFoundGoodWork'))
+    console.log(
+      chalk.bold(`Found ${numberOfVulnerableLibraries} vulnerabilities`)
+    )
+    console.log(
+      i18n.__(
+        'foundDetailedVulnerabilities',
+        String(0),
+        String(0),
+        String(0),
+        String(0),
+        String(0)
+      )
+    )
+  } else {
+    let numberOfCves = 0
+    vulnerableLibraries.forEach(lib => (numberOfCves += lib.cveArray.length))
+
+    const hasSomeVulnerabilitiesReported = printVulnerabilityResponse(
+      config,
+      vulnerableLibraries,
+      numberOfVulnerableLibraries,
+      numberOfCves,
+      guidance
+    )
 
-  const hasSomeVulnerabilitiesReported = printVulnerabilityResponse(
-    vulnerableLibraries,
-    config
-  )
+    return [
+      hasSomeVulnerabilitiesReported,
+      numberOfCves,
+      severityCountAllLibraries(vulnerableLibraries)
+    ]
+  }
+}
+
+export async function vulnerabilityReportV2(config: any, reportId: string) {
+  console.log()
+  const reportResponse = await getReport(config, reportId)
 
-  return [
-    hasSomeVulnerabilitiesReported,
-    numberOfCves,
-    severityCountAllLibraries(vulnerableLibraries)
-  ]
+  if (reportResponse !== undefined) {
+    const name = config.applicationName
+    formatVulnerabilityOutput(
+      reportResponse.vulnerabilities,
+      config.applicationId,
+      config,
+      reportResponse.remediationGuidance
+        ? reportResponse.remediationGuidance
+        : {}
+    )
+  }
 }