@contrast/contrast 1.0.7 → 1.0.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (196) hide show
  1. package/README.md +1 -1
  2. package/dist/audit/catalogueApplication/catalogueApplication.js +23 -5
  3. package/dist/audit/languageAnalysisEngine/getProjectRootFilenames.js +17 -26
  4. package/dist/audit/languageAnalysisEngine/report/commonReportingFunctions.js +98 -37
  5. package/dist/audit/languageAnalysisEngine/report/models/reportListModel.js +2 -1
  6. package/dist/audit/languageAnalysisEngine/report/models/reportOutputModel.js +4 -3
  7. package/dist/audit/languageAnalysisEngine/report/models/severityCountModel.js +3 -0
  8. package/dist/audit/languageAnalysisEngine/report/reportingFeature.js +87 -19
  9. package/dist/audit/languageAnalysisEngine/report/utils/reportUtils.js +40 -7
  10. package/dist/audit/languageAnalysisEngine/sendSnapshot.js +6 -30
  11. package/dist/audit/save.js +37 -0
  12. package/dist/commands/audit/auditConfig.js +0 -16
  13. package/dist/commands/audit/auditController.js +18 -11
  14. package/dist/commands/audit/help.js +31 -25
  15. package/dist/commands/audit/processAudit.js +2 -2
  16. package/dist/commands/audit/saveFile.js +8 -4
  17. package/dist/commands/scan/sca/scaAnalysis.js +54 -16
  18. package/dist/common/HTTPClient.js +14 -8
  19. package/dist/common/errorHandling.js +2 -2
  20. package/dist/common/versionChecker.js +19 -4
  21. package/dist/constants/constants.js +7 -2
  22. package/dist/constants/locales.js +44 -44
  23. package/dist/constants.js +31 -14
  24. package/dist/index.js +55 -45
  25. package/dist/lambda/lambda.js +5 -2
  26. package/dist/sbom/generateSbom.js +5 -4
  27. package/dist/scaAnalysis/common/formatMessage.js +33 -6
  28. package/dist/scaAnalysis/common/treeUpload.js +4 -6
  29. package/dist/scaAnalysis/dotnet/analysis.js +43 -0
  30. package/dist/scaAnalysis/dotnet/index.js +10 -0
  31. package/dist/scaAnalysis/go/goReadDepFile.js +1 -3
  32. package/dist/scaAnalysis/java/analysis.js +5 -5
  33. package/dist/scaAnalysis/javascript/analysis.js +107 -0
  34. package/dist/scaAnalysis/javascript/index.js +53 -0
  35. package/dist/scaAnalysis/php/analysis.js +70 -0
  36. package/dist/scaAnalysis/php/index.js +17 -0
  37. package/dist/scaAnalysis/python/analysis.js +8 -7
  38. package/dist/scaAnalysis/ruby/analysis.js +8 -16
  39. package/dist/scaAnalysis/ruby/index.js +2 -2
  40. package/dist/scan/autoDetection.js +13 -24
  41. package/dist/scan/fileUtils.js +44 -14
  42. package/dist/scan/formatScanOutput.js +3 -3
  43. package/dist/scan/scanConfig.js +2 -2
  44. package/dist/utils/commonApi.js +1 -1
  45. package/dist/utils/filterProjectPath.js +7 -2
  46. package/dist/utils/getConfig.js +1 -6
  47. package/package.json +2 -3
  48. package/src/audit/catalogueApplication/catalogueApplication.js +28 -6
  49. package/src/audit/languageAnalysisEngine/getProjectRootFilenames.js +22 -58
  50. package/src/audit/languageAnalysisEngine/report/commonReportingFunctions.ts +157 -47
  51. package/src/audit/languageAnalysisEngine/report/models/reportListModel.ts +4 -1
  52. package/src/audit/languageAnalysisEngine/report/models/reportOutputModel.ts +11 -5
  53. package/src/audit/languageAnalysisEngine/report/models/severityCountModel.ts +4 -0
  54. package/src/audit/languageAnalysisEngine/report/reportingFeature.ts +86 -32
  55. package/src/audit/languageAnalysisEngine/report/utils/reportUtils.ts +44 -5
  56. package/src/audit/languageAnalysisEngine/sendSnapshot.js +6 -32
  57. package/src/audit/save.js +48 -0
  58. package/src/commands/audit/auditConfig.ts +0 -25
  59. package/src/commands/audit/auditController.ts +18 -20
  60. package/src/commands/audit/help.ts +31 -25
  61. package/src/commands/audit/processAudit.ts +2 -5
  62. package/src/commands/audit/saveFile.ts +6 -2
  63. package/src/commands/scan/processScan.js +0 -1
  64. package/src/commands/scan/sca/scaAnalysis.js +87 -32
  65. package/src/common/HTTPClient.js +16 -9
  66. package/src/common/errorHandling.ts +2 -3
  67. package/src/common/versionChecker.ts +23 -4
  68. package/src/constants/constants.js +9 -3
  69. package/src/constants/locales.js +72 -50
  70. package/src/constants.js +32 -15
  71. package/src/index.ts +70 -58
  72. package/src/lambda/lambda.ts +5 -2
  73. package/src/lambda/types.ts +1 -0
  74. package/src/sbom/generateSbom.ts +2 -2
  75. package/src/scaAnalysis/common/formatMessage.js +35 -6
  76. package/src/scaAnalysis/common/treeUpload.js +4 -6
  77. package/src/scaAnalysis/dotnet/analysis.js +54 -0
  78. package/src/scaAnalysis/dotnet/index.js +11 -0
  79. package/src/scaAnalysis/go/goReadDepFile.js +1 -3
  80. package/src/scaAnalysis/java/analysis.js +5 -5
  81. package/src/scaAnalysis/javascript/analysis.js +126 -0
  82. package/src/scaAnalysis/javascript/index.js +75 -0
  83. package/src/scaAnalysis/php/analysis.js +78 -0
  84. package/src/scaAnalysis/php/index.js +22 -0
  85. package/src/scaAnalysis/python/analysis.js +8 -7
  86. package/src/scaAnalysis/ruby/analysis.js +8 -17
  87. package/src/scaAnalysis/ruby/index.js +2 -2
  88. package/src/scan/autoDetection.js +14 -27
  89. package/src/scan/fileUtils.js +46 -14
  90. package/src/scan/formatScanOutput.ts +3 -3
  91. package/src/scan/scanConfig.js +2 -4
  92. package/src/utils/commonApi.js +1 -1
  93. package/src/utils/filterProjectPath.js +6 -2
  94. package/src/utils/getConfig.ts +1 -12
  95. package/dist/audit/AnalysisEngine.js +0 -37
  96. package/dist/audit/autodetection/autoDetectLanguage.js +0 -32
  97. package/dist/audit/dotnetAnalysisEngine/index.js +0 -25
  98. package/dist/audit/dotnetAnalysisEngine/parseLockFileContents.js +0 -35
  99. package/dist/audit/dotnetAnalysisEngine/parseProjectFileContents.js +0 -15
  100. package/dist/audit/dotnetAnalysisEngine/readLockFileContents.js +0 -18
  101. package/dist/audit/dotnetAnalysisEngine/readProjectFileContents.js +0 -14
  102. package/dist/audit/dotnetAnalysisEngine/sanitizer.js +0 -9
  103. package/dist/audit/goAnalysisEngine/index.js +0 -17
  104. package/dist/audit/goAnalysisEngine/parseProjectFileContents.js +0 -164
  105. package/dist/audit/goAnalysisEngine/readProjectFileContents.js +0 -21
  106. package/dist/audit/goAnalysisEngine/sanitizer.js +0 -5
  107. package/dist/audit/javaAnalysisEngine/index.js +0 -34
  108. package/dist/audit/javaAnalysisEngine/parseMavenProjectFileContents.js +0 -155
  109. package/dist/audit/javaAnalysisEngine/parseProjectFileContents.js +0 -353
  110. package/dist/audit/javaAnalysisEngine/readProjectFileContents.js +0 -98
  111. package/dist/audit/javaAnalysisEngine/sanitizer.js +0 -5
  112. package/dist/audit/languageAnalysisEngine/checkForMultipleIdentifiedLanguages.js +0 -25
  113. package/dist/audit/languageAnalysisEngine/checkForMultipleIdentifiedProjectFiles.js +0 -25
  114. package/dist/audit/languageAnalysisEngine/checkIdentifiedLanguageHasLockFile.js +0 -35
  115. package/dist/audit/languageAnalysisEngine/checkIdentifiedLanguageHasProjectFile.js +0 -24
  116. package/dist/audit/languageAnalysisEngine/constants.js +0 -20
  117. package/dist/audit/languageAnalysisEngine/getIdentifiedLanguageInfo.js +0 -25
  118. package/dist/audit/languageAnalysisEngine/index.js +0 -39
  119. package/dist/audit/languageAnalysisEngine/languageAnalysisFactory.js +0 -89
  120. package/dist/audit/languageAnalysisEngine/reduceIdentifiedLanguages.js +0 -159
  121. package/dist/audit/nodeAnalysisEngine/handleNPMLockFileV2.js +0 -40
  122. package/dist/audit/nodeAnalysisEngine/index.js +0 -31
  123. package/dist/audit/nodeAnalysisEngine/parseNPMLockFileContents.js +0 -18
  124. package/dist/audit/nodeAnalysisEngine/parseYarnLockFileContents.js +0 -18
  125. package/dist/audit/nodeAnalysisEngine/readNPMLockFileContents.js +0 -17
  126. package/dist/audit/nodeAnalysisEngine/readProjectFileContents.js +0 -14
  127. package/dist/audit/nodeAnalysisEngine/readYarnLockFileContents.js +0 -24
  128. package/dist/audit/nodeAnalysisEngine/sanitizer.js +0 -9
  129. package/dist/audit/phpAnalysisEngine/index.js +0 -23
  130. package/dist/audit/phpAnalysisEngine/parseLockFileContents.js +0 -52
  131. package/dist/audit/phpAnalysisEngine/readLockFileContents.js +0 -13
  132. package/dist/audit/phpAnalysisEngine/readProjectFileContents.js +0 -16
  133. package/dist/audit/phpAnalysisEngine/sanitizer.js +0 -5
  134. package/dist/audit/pythonAnalysisEngine/index.js +0 -25
  135. package/dist/audit/pythonAnalysisEngine/parsePipfileLockContents.js +0 -17
  136. package/dist/audit/pythonAnalysisEngine/parseProjectFileContents.js +0 -21
  137. package/dist/audit/pythonAnalysisEngine/readPipfileLockFileContents.js +0 -13
  138. package/dist/audit/pythonAnalysisEngine/readPythonProjectFileContents.js +0 -14
  139. package/dist/audit/pythonAnalysisEngine/sanitizer.js +0 -7
  140. package/dist/audit/rubyAnalysisEngine/index.js +0 -25
  141. package/dist/audit/rubyAnalysisEngine/parseGemfileLockContents.js +0 -176
  142. package/dist/audit/rubyAnalysisEngine/parsedGemfile.js +0 -22
  143. package/dist/audit/rubyAnalysisEngine/readGemfileContents.js +0 -14
  144. package/dist/audit/rubyAnalysisEngine/readGemfileLockContents.js +0 -14
  145. package/dist/audit/rubyAnalysisEngine/sanitizer.js +0 -6
  146. package/src/audit/AnalysisEngine.js +0 -103
  147. package/src/audit/autodetection/autoDetectLanguage.ts +0 -40
  148. package/src/audit/dotnetAnalysisEngine/index.js +0 -26
  149. package/src/audit/dotnetAnalysisEngine/parseLockFileContents.js +0 -47
  150. package/src/audit/dotnetAnalysisEngine/parseProjectFileContents.js +0 -29
  151. package/src/audit/dotnetAnalysisEngine/readLockFileContents.js +0 -30
  152. package/src/audit/dotnetAnalysisEngine/readProjectFileContents.js +0 -26
  153. package/src/audit/dotnetAnalysisEngine/sanitizer.js +0 -11
  154. package/src/audit/goAnalysisEngine/index.js +0 -18
  155. package/src/audit/goAnalysisEngine/parseProjectFileContents.js +0 -209
  156. package/src/audit/goAnalysisEngine/readProjectFileContents.js +0 -31
  157. package/src/audit/goAnalysisEngine/sanitizer.js +0 -7
  158. package/src/audit/javaAnalysisEngine/index.js +0 -41
  159. package/src/audit/javaAnalysisEngine/parseMavenProjectFileContents.js +0 -225
  160. package/src/audit/javaAnalysisEngine/parseProjectFileContents.js +0 -420
  161. package/src/audit/javaAnalysisEngine/readProjectFileContents.js +0 -141
  162. package/src/audit/javaAnalysisEngine/sanitizer.js +0 -6
  163. package/src/audit/languageAnalysisEngine/checkForMultipleIdentifiedLanguages.js +0 -36
  164. package/src/audit/languageAnalysisEngine/checkForMultipleIdentifiedProjectFiles.js +0 -42
  165. package/src/audit/languageAnalysisEngine/checkIdentifiedLanguageHasLockFile.js +0 -54
  166. package/src/audit/languageAnalysisEngine/checkIdentifiedLanguageHasProjectFile.js +0 -33
  167. package/src/audit/languageAnalysisEngine/constants.js +0 -23
  168. package/src/audit/languageAnalysisEngine/getIdentifiedLanguageInfo.js +0 -41
  169. package/src/audit/languageAnalysisEngine/index.js +0 -45
  170. package/src/audit/languageAnalysisEngine/languageAnalysisFactory.js +0 -124
  171. package/src/audit/languageAnalysisEngine/reduceIdentifiedLanguages.js +0 -250
  172. package/src/audit/nodeAnalysisEngine/handleNPMLockFileV2.js +0 -49
  173. package/src/audit/nodeAnalysisEngine/index.js +0 -35
  174. package/src/audit/nodeAnalysisEngine/parseNPMLockFileContents.js +0 -20
  175. package/src/audit/nodeAnalysisEngine/parseYarnLockFileContents.js +0 -26
  176. package/src/audit/nodeAnalysisEngine/readNPMLockFileContents.js +0 -23
  177. package/src/audit/nodeAnalysisEngine/readProjectFileContents.js +0 -27
  178. package/src/audit/nodeAnalysisEngine/readYarnLockFileContents.js +0 -36
  179. package/src/audit/nodeAnalysisEngine/sanitizer.js +0 -11
  180. package/src/audit/phpAnalysisEngine/index.js +0 -27
  181. package/src/audit/phpAnalysisEngine/parseLockFileContents.js +0 -60
  182. package/src/audit/phpAnalysisEngine/readLockFileContents.js +0 -14
  183. package/src/audit/phpAnalysisEngine/readProjectFileContents.js +0 -25
  184. package/src/audit/phpAnalysisEngine/sanitizer.js +0 -4
  185. package/src/audit/pythonAnalysisEngine/index.js +0 -55
  186. package/src/audit/pythonAnalysisEngine/parsePipfileLockContents.js +0 -23
  187. package/src/audit/pythonAnalysisEngine/parseProjectFileContents.js +0 -33
  188. package/src/audit/pythonAnalysisEngine/readPipfileLockFileContents.js +0 -16
  189. package/src/audit/pythonAnalysisEngine/readPythonProjectFileContents.js +0 -22
  190. package/src/audit/pythonAnalysisEngine/sanitizer.js +0 -9
  191. package/src/audit/rubyAnalysisEngine/index.js +0 -30
  192. package/src/audit/rubyAnalysisEngine/parseGemfileLockContents.js +0 -215
  193. package/src/audit/rubyAnalysisEngine/parsedGemfile.js +0 -39
  194. package/src/audit/rubyAnalysisEngine/readGemfileContents.js +0 -18
  195. package/src/audit/rubyAnalysisEngine/readGemfileLockContents.js +0 -17
  196. package/src/audit/rubyAnalysisEngine/sanitizer.js +0 -8
@@ -5,7 +5,7 @@ const i18n = require('i18n');
5
5
  const fs = require('fs');
6
6
  const MAVEN = 'maven';
7
7
  const GRADLE = 'gradle';
8
- const determineProjectTypeAndCwd = (files, projectPath) => {
8
+ const determineProjectTypeAndCwd = (files, file) => {
9
9
  const projectData = {};
10
10
  if (files[0].includes('pom.xml')) {
11
11
  projectData.projectType = MAVEN;
@@ -13,9 +13,9 @@ const determineProjectTypeAndCwd = (files, projectPath) => {
13
13
  else if (files[0].includes('build.gradle')) {
14
14
  projectData.projectType = GRADLE;
15
15
  }
16
- projectData.cwd = projectPath
17
- ? projectPath.replace('pom.xml', '').replace('build.gradle', '')
18
- : projectPath;
16
+ projectData.cwd = file
17
+ ? file.replace('pom.xml', '').replace('build.gradle', '')
18
+ : file;
19
19
  return projectData;
20
20
  };
21
21
  const buildMaven = (config, projectData, timeout) => {
@@ -86,7 +86,7 @@ const getJavaBuildDeps = (config, files) => {
86
86
  projectType: undefined
87
87
  };
88
88
  try {
89
- const projectData = determineProjectTypeAndCwd(files, config.projectPath);
89
+ const projectData = determineProjectTypeAndCwd(files, config.file);
90
90
  if (projectData.projectType === MAVEN) {
91
91
  output.mvnDependancyTreeOutput = buildMaven(config, projectData, timeout);
92
92
  }
@@ -0,0 +1,107 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const yarnParser = require('@yarnpkg/lockfile');
4
+ const yaml = require('js-yaml');
5
+ const i18n = require('i18n');
6
+ const { formatKey } = require('../../audit/nodeAnalysisEngine/parseYarn2LockFileContents');
7
+ const readFile = async (config, languageFiles, nameOfFile) => {
8
+ const index = languageFiles.findIndex(v => v.includes(nameOfFile));
9
+ if (config.file) {
10
+ return fs.readFileSync(config.file.concat(languageFiles[index]), 'utf8');
11
+ }
12
+ else {
13
+ throw new Error('could not find file');
14
+ }
15
+ };
16
+ const readYarn = async (config, languageFiles, nameOfFile) => {
17
+ let yarn = {
18
+ yarnVersion: 1,
19
+ rawYarnLockFileContents: ''
20
+ };
21
+ try {
22
+ let rawYarnLockFileContents = await readFile(config, languageFiles, nameOfFile);
23
+ yarn.rawYarnLockFileContents = rawYarnLockFileContents;
24
+ if (!yarn.rawYarnLockFileContents.includes('lockfile v1') ||
25
+ yarn.rawYarnLockFileContents.includes('__metadata')) {
26
+ yarn.rawYarnLockFileContents = yaml.load(rawYarnLockFileContents);
27
+ yarn.yarnVersion = 2;
28
+ }
29
+ return yarn;
30
+ }
31
+ catch (err) {
32
+ throw new Error(i18n.__('nodeReadYarnLockFileError') + `${err.message}`);
33
+ }
34
+ };
35
+ const parseNpmLockFile = async (js) => {
36
+ try {
37
+ js.npmLockFile = JSON.parse(js.rawLockFileContents);
38
+ if (js.npmLockFile && js.npmLockFile.lockfileVersion > 1) {
39
+ const listOfTopDep = Object.keys(js.npmLockFile.dependencies);
40
+ Object.entries(js.npmLockFile.dependencies).forEach(([objKey, value]) => {
41
+ if (value.requires) {
42
+ const listOfRequiresDep = Object.keys(value.requires);
43
+ listOfRequiresDep.forEach(dep => {
44
+ if (!listOfTopDep.includes(dep)) {
45
+ addDepToLockFile(js, value['requires'], dep);
46
+ }
47
+ });
48
+ }
49
+ if (value.dependencies) {
50
+ Object.entries(value.dependencies).forEach(([objChildKey, childValue]) => {
51
+ if (childValue.requires) {
52
+ const listOfRequiresDep = Object.keys(childValue.requires);
53
+ listOfRequiresDep.forEach(dep => {
54
+ if (!listOfTopDep.includes(dep)) {
55
+ addDepToLockFile(js, childValue['requires'], dep);
56
+ }
57
+ });
58
+ }
59
+ });
60
+ }
61
+ });
62
+ return js.npmLockFile;
63
+ }
64
+ else {
65
+ return js.npmLockFile;
66
+ }
67
+ }
68
+ catch (err) {
69
+ throw new Error(i18n.__('NodeParseNPM') + `${err.message}`);
70
+ }
71
+ };
72
+ const addDepToLockFile = (js, depObj, key) => {
73
+ return (js.npmLockFile.dependencies[key] = { version: depObj[key] });
74
+ };
75
+ const parseYarnLockFile = async (js) => {
76
+ try {
77
+ js.yarn.yarnLockFile = {};
78
+ if (js.yarn.yarnVersion === 1) {
79
+ js.yarn.yarnLockFile = yarnParser.parse(js.yarn.rawYarnLockFileContents);
80
+ delete js.yarn.rawYarnLockFileContents;
81
+ return js;
82
+ }
83
+ else {
84
+ js.yarn.yarnLockFile['object'] = js.yarn.rawYarnLockFileContents;
85
+ delete js.yarn.yarnLockFile['object'].__metadata;
86
+ js.yarn.yarnLockFile['type'] = 'success';
87
+ Object.entries(js.yarn.rawYarnLockFileContents).forEach(([key, value]) => {
88
+ const rawKeyNames = key.split(',');
89
+ const keyNames = formatKey(rawKeyNames);
90
+ keyNames.forEach(name => {
91
+ js.yarn.yarnLockFile.object[name] = value;
92
+ });
93
+ });
94
+ return js;
95
+ }
96
+ }
97
+ catch (err) {
98
+ throw new Error(i18n.__('NodeParseYarn', js.yarn.yarnVersion) + `${err.message}`);
99
+ }
100
+ };
101
+ module.exports = {
102
+ readYarn,
103
+ parseYarnLockFile,
104
+ parseNpmLockFile,
105
+ readFile,
106
+ formatKey
107
+ };
@@ -0,0 +1,53 @@
1
+ "use strict";
2
+ const analysis = require('./analysis');
3
+ const i18n = require('i18n');
4
+ const formatMessage = require('../common/formatMessage');
5
+ const jsAnalysis = async (config, languageFiles) => {
6
+ checkForCorrectFiles(languageFiles);
7
+ if (!config.file.endsWith('/')) {
8
+ config.file = config.file.concat('/');
9
+ }
10
+ return buildNodeTree(config, languageFiles.JAVASCRIPT);
11
+ };
12
+ const buildNodeTree = async (config, files) => {
13
+ let analysis = await readFiles(config, files);
14
+ const rawNode = await parseFiles(config, files, analysis);
15
+ return formatMessage.createJavaScriptTSMessage(rawNode);
16
+ };
17
+ const readFiles = async (config, files) => {
18
+ let js = {};
19
+ js.packageJSON = JSON.parse(await analysis.readFile(config, files, 'package.json'));
20
+ if (files.includes('package-lock.json')) {
21
+ js.rawLockFileContents = await analysis.readFile(config, files, 'package-lock.json');
22
+ }
23
+ if (files.includes('yarn.lock')) {
24
+ js.yarn = {};
25
+ js.yarn = await analysis.readYarn(config, files, 'yarn.lock');
26
+ }
27
+ return js;
28
+ };
29
+ const parseFiles = async (config, files, js) => {
30
+ if (files.includes('package-lock.json')) {
31
+ js.npmLockFile = await analysis.parseNpmLockFile(js);
32
+ }
33
+ if (files.includes('yarn.lock')) {
34
+ js = await analysis.parseYarnLockFile(js);
35
+ }
36
+ return js;
37
+ };
38
+ const checkForCorrectFiles = languageFiles => {
39
+ if (languageFiles.JAVASCRIPT.includes('package-lock.json') &&
40
+ languageFiles.JAVASCRIPT.includes('yarn.lock')) {
41
+ throw new Error(i18n.__('languageAnalysisHasMultipleLockFiles', 'javascript'));
42
+ }
43
+ if (!languageFiles.JAVASCRIPT.includes('package-lock.json') &&
44
+ !languageFiles.JAVASCRIPT.includes('yarn.lock')) {
45
+ throw new Error(i18n.__('languageAnalysisHasNoLockFile', 'javascript'));
46
+ }
47
+ if (!languageFiles.JAVASCRIPT.includes('package.json')) {
48
+ throw new Error(i18n.__('languageAnalysisHasNoPackageJsonFile'));
49
+ }
50
+ };
51
+ module.exports = {
52
+ jsAnalysis
53
+ };
@@ -0,0 +1,70 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const i18n = require('i18n');
4
+ const _ = require('lodash');
5
+ const readFile = (config, nameOfFile) => {
6
+ if (config.file) {
7
+ try {
8
+ return fs.readFileSync(config.file + '/' + nameOfFile);
9
+ }
10
+ catch (error) {
11
+ console.log('Unable to find file');
12
+ console.log(error);
13
+ }
14
+ }
15
+ };
16
+ const parseProjectFiles = php => {
17
+ try {
18
+ php.composerJSON.dependencies = php.composerJSON.require;
19
+ php.composerJSON.devDependencies = php.composerJSON['require-dev'];
20
+ php.lockFile = php.rawLockFileContents;
21
+ let packages = _.keyBy(php.lockFile.packages, 'name');
22
+ let packagesDev = _.keyBy(php.lockFile['packages-dev'], 'name');
23
+ php.lockFile.dependencies = _.merge(packages, packagesDev);
24
+ const listOfTopDep = Object.keys(php.lockFile.dependencies);
25
+ Object.entries(php.lockFile.dependencies).forEach(([key, value]) => {
26
+ if (value.require) {
27
+ const listOfRequiresDep = Object.keys(value.require);
28
+ listOfRequiresDep.forEach(dep => {
29
+ if (!listOfTopDep.includes(dep)) {
30
+ addChildDepToLockFileAsOwnObj(php, value['require'], dep);
31
+ }
32
+ });
33
+ }
34
+ if (value['require-dev']) {
35
+ const listOfRequiresDep = Object.keys(value['require-dev']);
36
+ listOfRequiresDep.forEach(dep => {
37
+ if (!listOfTopDep.includes(dep)) {
38
+ addChildDepToLockFileAsOwnObj(php, value['require-dev'], dep);
39
+ }
40
+ });
41
+ }
42
+ });
43
+ formatParentDepToLockFile(php);
44
+ delete php.rawLockFileContents;
45
+ return php;
46
+ }
47
+ catch (err) {
48
+ return console.log(i18n.__('phpParseComposerLock', php) + `${err.message}`);
49
+ }
50
+ };
51
+ function addChildDepToLockFileAsOwnObj(php, depObj, key) {
52
+ php.lockFile.dependencies[key] = { version: depObj[key] };
53
+ }
54
+ function formatParentDepToLockFile(php) {
55
+ for (const [key, value] of Object.entries(php.lockFile.dependencies)) {
56
+ let requires = {};
57
+ for (const [childKey, childValue] of Object.entries(value)) {
58
+ if (childKey === 'require' || childKey === 'require-dev') {
59
+ requires = _.merge(requires, childValue);
60
+ php.lockFile.dependencies[key].requires = requires;
61
+ delete php.lockFile.dependencies[key].require;
62
+ delete php.lockFile.dependencies[key]['require-dev'];
63
+ }
64
+ }
65
+ }
66
+ }
67
+ module.exports = {
68
+ parseProjectFiles,
69
+ readFile
70
+ };
@@ -0,0 +1,17 @@
1
+ "use strict";
2
+ const { readFile, parseProjectFiles } = require('./analysis');
3
+ const { createPhpTSMessage } = require('../common/formatMessage');
4
+ const phpAnalysis = (config, files) => {
5
+ let analysis = readFiles(config, files.PHP);
6
+ const phpDep = parseProjectFiles(analysis);
7
+ return createPhpTSMessage(phpDep);
8
+ };
9
+ const readFiles = (config, files) => {
10
+ let php = {};
11
+ php.composerJSON = JSON.parse(readFile(config, 'composer.json'));
12
+ php.rawLockFileContents = JSON.parse(readFile(config, 'composer.lock'));
13
+ return php;
14
+ };
15
+ module.exports = {
16
+ phpAnalysis
17
+ };
@@ -1,8 +1,8 @@
1
1
  "use strict";
2
2
  const multiReplace = require('string-multiple-replace');
3
3
  const fs = require('fs');
4
- const readAndParseProjectFile = projectPath => {
5
- const filePath = filePathForWindows(projectPath + '/Pipfile');
4
+ const readAndParseProjectFile = file => {
5
+ const filePath = filePathForWindows(file + '/Pipfile');
6
6
  const pipFile = fs.readFileSync(filePath, 'utf8');
7
7
  const matcherObj = { '"': '' };
8
8
  const sequencer = ['"'];
@@ -10,18 +10,19 @@ const readAndParseProjectFile = projectPath => {
10
10
  const pythonArray = parsedPipfile.split('\n');
11
11
  return pythonArray.filter(element => element !== '' && !element.includes('#'));
12
12
  };
13
- const readAndParseLockFile = projectPath => {
14
- const filePath = filePathForWindows(projectPath + '/Pipfile.lock');
13
+ const readAndParseLockFile = file => {
14
+ const filePath = filePathForWindows(file + '/Pipfile.lock');
15
15
  const lockFile = fs.readFileSync(filePath, 'utf8');
16
16
  let parsedPipLock = JSON.parse(lockFile);
17
17
  parsedPipLock['defaults'] = parsedPipLock['default'];
18
+ delete parsedPipLock['default'];
18
19
  return parsedPipLock;
19
20
  };
20
21
  const getPythonDeps = config => {
21
22
  try {
22
- const parseProject = readAndParseProjectFile(config.projectPath);
23
- const parsePip = readAndParseLockFile(config.projectPath);
24
- return { pipfileLock: parseProject, pipfilDependanceies: parsePip };
23
+ const parseProject = readAndParseProjectFile(config.file);
24
+ const parsePip = readAndParseLockFile(config.file);
25
+ return { pipfileLock: parsePip, pipfilDependanceies: parseProject };
25
26
  }
26
27
  catch (err) {
27
28
  console.log(err.message.toString());
@@ -1,8 +1,7 @@
1
1
  "use strict";
2
2
  const fs = require('fs');
3
- const readAndParseGemfile = projectPath => {
4
- const fileName = filePathForWindows(projectPath + '/Gemfile');
5
- const gemFile = fs.readFileSync(fileName, 'utf8');
3
+ const readAndParseGemfile = file => {
4
+ const gemFile = fs.readFileSync(file + '/Gemfile', 'utf8');
6
5
  const rubyArray = gemFile.split('\n');
7
6
  let filteredRubyDep = rubyArray.filter(element => {
8
7
  return (!element.includes('#') &&
@@ -14,9 +13,8 @@ const readAndParseGemfile = projectPath => {
14
13
  }
15
14
  return filteredRubyDep;
16
15
  };
17
- const readAndParseGemLockFile = projectPath => {
18
- const fileName = filePathForWindows(projectPath + '/Gemfile.lock');
19
- const lockFile = fs.readFileSync(fileName, 'utf8');
16
+ const readAndParseGemLockFile = file => {
17
+ const lockFile = fs.readFileSync(file + '/Gemfile.lock', 'utf8');
20
18
  const dependencyRegEx = /^\s*([A-Za-z0-9.!@#$%\-^&*_+]*)\s*(\((.*?)\))/;
21
19
  const lines = lockFile.split('\n');
22
20
  return {
@@ -26,7 +24,7 @@ const readAndParseGemLockFile = projectPath => {
26
24
  };
27
25
  };
28
26
  const nonDependencyKeys = (line, sourceObject) => {
29
- const GEMFILE_KEY_VALUE = /^\s*([^:(]*)\s*\s*(.*)/;
27
+ const GEMFILE_KEY_VALUE = /^\s*([^:(]*)\s*\:*\s*(.*)/;
30
28
  let parts = GEMFILE_KEY_VALUE.exec(line);
31
29
  let key = parts[1].trim();
32
30
  let value = parts[2] || '';
@@ -164,7 +162,7 @@ const getSourceArray = (lines, dependencyRegEx) => {
164
162
  }
165
163
  if ((currentWS === 4 && nexlineWS === 4) ||
166
164
  (currentWS === 6 && nexlineWS === 4) ||
167
- nexlineWS === '') {
165
+ nexlineWS == '') {
168
166
  let newObj = {};
169
167
  newObj = JSON.parse(JSON.stringify(sourceObject));
170
168
  sources.push(newObj);
@@ -192,8 +190,8 @@ const buildSourceDependencyWithVersion = (whitespaceRegx, dependencyRegEx, line,
192
190
  };
193
191
  const getRubyDeps = config => {
194
192
  try {
195
- const parsedGem = readAndParseGemfile(config.projectPath);
196
- const parsedLock = readAndParseGemLockFile(config.projectPath);
193
+ const parsedGem = readAndParseGemfile(config.file);
194
+ const parsedLock = readAndParseGemLockFile(config.file);
197
195
  return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock };
198
196
  }
199
197
  catch (err) {
@@ -204,12 +202,6 @@ const getRubyDeps = config => {
204
202
  const trimWhiteSpace = string => {
205
203
  return string.replace(/\s+/g, '');
206
204
  };
207
- const filePathForWindows = path => {
208
- if (process.platform === 'win32') {
209
- path = path.replace(/\//g, '\\');
210
- }
211
- return path;
212
- };
213
205
  module.exports = {
214
206
  getRubyDeps,
215
207
  readAndParseGemfile,
@@ -1,8 +1,8 @@
1
1
  "use strict";
2
- const { getRubyDeps } = require('./analysis');
2
+ const analysis = require('./analysis');
3
3
  const { createRubyTSMessage } = require('../common/formatMessage');
4
4
  const rubyAnalysis = (config, languageFiles) => {
5
- const rubyDeps = getRubyDeps(config, languageFiles.RUBY);
5
+ const rubyDeps = analysis.getRubyDeps(config, languageFiles.RUBY);
6
6
  return createRubyTSMessage(rubyDeps);
7
7
  };
8
8
  module.exports = {
@@ -1,8 +1,8 @@
1
1
  "use strict";
2
2
  const i18n = require('i18n');
3
3
  const fileFinder = require('./fileUtils');
4
- const languageResolver = require('../audit/languageAnalysisEngine/reduceIdentifiedLanguages');
5
4
  const rootFile = require('../audit/languageAnalysisEngine/getProjectRootFilenames');
5
+ const path = require('path');
6
6
  const autoDetectFileAndLanguage = async (configToUse) => {
7
7
  const entries = await fileFinder.findFile();
8
8
  if (entries.length === 1) {
@@ -24,30 +24,20 @@ const autoDetectFileAndLanguage = async (configToUse) => {
24
24
  errorOnFileDetection(entries);
25
25
  }
26
26
  };
27
- const autoDetectAuditFilesAndLanguages = async () => {
27
+ const autoDetectAuditFilesAndLanguages = async (filePath) => {
28
28
  let languagesFound = [];
29
- console.log(i18n.__('searchingAuditFileDirectory', process.cwd()));
30
- await fileFinder.findFilesJava(languagesFound);
31
- await fileFinder.findFilesJavascript(languagesFound);
32
- await fileFinder.findFilesPython(languagesFound);
33
- await fileFinder.findFilesGo(languagesFound);
34
- await fileFinder.findFilesPhp(languagesFound);
35
- await fileFinder.findFilesRuby(languagesFound);
36
- if (languagesFound.length === 1) {
29
+ console.log(i18n.__('searchingAuditFileDirectory', filePath));
30
+ await fileFinder.findFilesJava(languagesFound, filePath);
31
+ await fileFinder.findFilesJavascript(languagesFound, filePath);
32
+ await fileFinder.findFilesPython(languagesFound, filePath);
33
+ await fileFinder.findFilesGo(languagesFound, filePath);
34
+ await fileFinder.findFilesPhp(languagesFound, filePath);
35
+ await fileFinder.findFilesRuby(languagesFound, filePath);
36
+ await fileFinder.findFilesDotNet(languagesFound, filePath);
37
+ if (languagesFound) {
37
38
  return languagesFound;
38
39
  }
39
- else {
40
- console.log('found multiple languages, please specify one using --file to run SCA analysis');
41
- }
42
- };
43
- const manualDetectAuditFilesAndLanguages = projectPath => {
44
- let projectRootFilenames = rootFile.getProjectRootFilenames(projectPath);
45
- let identifiedLanguages = languageResolver.deduceLanguageScaAnalysis(projectRootFilenames);
46
- if (Object.keys(identifiedLanguages).length === 0) {
47
- console.log(i18n.__('languageAnalysisNoLanguage', projectPath));
48
- return [];
49
- }
50
- return [identifiedLanguages];
40
+ return [];
51
41
  };
52
42
  const hasWhiteSpace = s => {
53
43
  const filename = s.split('/').pop();
@@ -88,6 +78,5 @@ module.exports = {
88
78
  autoDetectFileAndLanguage,
89
79
  errorOnFileDetection,
90
80
  autoDetectAuditFilesAndLanguages,
91
- errorOnAuditFileDetection,
92
- manualDetectAuditFilesAndLanguages
81
+ errorOnAuditFileDetection
93
82
  };
@@ -10,72 +10,90 @@ const findFile = async () => {
10
10
  onlyFiles: true
11
11
  });
12
12
  };
13
- const findFilesJava = async (languagesFound) => {
13
+ const findFilesJava = async (languagesFound, filePath) => {
14
14
  const result = await fg(['**/pom.xml', '**/build.gradle', '**/build.gradle.kts'], {
15
15
  dot: false,
16
16
  deep: 1,
17
- onlyFiles: true
17
+ onlyFiles: true,
18
+ cwd: filePath ? filePath : process.cwd()
18
19
  });
19
20
  if (result.length > 0) {
20
21
  return languagesFound.push({ JAVA: result });
21
22
  }
22
23
  return languagesFound;
23
24
  };
24
- const findFilesJavascript = async (languagesFound) => {
25
- const result = await fg(['**/package.json', '**/yarn.lock', '**/package.lock.json'], {
25
+ const findFilesJavascript = async (languagesFound, filePath) => {
26
+ const result = await fg(['**/package.json', '**/yarn.lock', '**/package-lock.json'], {
26
27
  dot: false,
27
28
  deep: 1,
28
- onlyFiles: true
29
+ onlyFiles: true,
30
+ cwd: filePath ? filePath : process.cwd()
29
31
  });
30
32
  if (result.length > 0) {
31
33
  return languagesFound.push({ JAVASCRIPT: result });
32
34
  }
33
35
  return languagesFound;
34
36
  };
35
- const findFilesPython = async (languagesFound) => {
37
+ const findFilesPython = async (languagesFound, filePath) => {
36
38
  const result = await fg(['**/Pipfile.lock', '**/Pipfile'], {
37
39
  dot: false,
38
40
  deep: 3,
39
- onlyFiles: true
41
+ onlyFiles: true,
42
+ cwd: filePath ? filePath : process.cwd()
40
43
  });
41
44
  if (result.length > 0) {
42
45
  return languagesFound.push({ PYTHON: result });
43
46
  }
44
47
  return languagesFound;
45
48
  };
46
- const findFilesGo = async (languagesFound) => {
49
+ const findFilesGo = async (languagesFound, filePath) => {
47
50
  const result = await fg(['**/go.mod'], {
48
51
  dot: false,
49
52
  deep: 3,
50
- onlyFiles: true
53
+ onlyFiles: true,
54
+ cwd: filePath ? filePath : process.cwd()
51
55
  });
52
56
  if (result.length > 0) {
53
57
  return languagesFound.push({ GO: result });
54
58
  }
55
59
  return languagesFound;
56
60
  };
57
- const findFilesRuby = async (languagesFound) => {
61
+ const findFilesRuby = async (languagesFound, filePath) => {
58
62
  const result = await fg(['**/Gemfile', '**/Gemfile.lock'], {
59
63
  dot: false,
60
64
  deep: 3,
61
- onlyFiles: true
65
+ onlyFiles: true,
66
+ cwd: filePath ? filePath : process.cwd()
62
67
  });
63
68
  if (result.length > 0) {
64
69
  return languagesFound.push({ RUBY: result });
65
70
  }
66
71
  return languagesFound;
67
72
  };
68
- const findFilesPhp = async (languagesFound) => {
73
+ const findFilesPhp = async (languagesFound, filePath) => {
69
74
  const result = await fg(['**/composer.json', '**/composer.lock'], {
70
75
  dot: false,
71
76
  deep: 3,
72
- onlyFiles: true
77
+ onlyFiles: true,
78
+ cwd: filePath ? filePath : process.cwd()
73
79
  });
74
80
  if (result.length > 0) {
75
81
  return languagesFound.push({ PHP: result });
76
82
  }
77
83
  return languagesFound;
78
84
  };
85
+ const findFilesDotNet = async (languagesFound, filePath) => {
86
+ const result = await fg(['**/*.csproj', '**/packages.lock.json'], {
87
+ dot: false,
88
+ deep: 3,
89
+ onlyFiles: true,
90
+ cwd: filePath ? filePath : process.cwd()
91
+ });
92
+ if (result.length > 0) {
93
+ return languagesFound.push({ DOTNET: result });
94
+ }
95
+ return languagesFound;
96
+ };
79
97
  const checkFilePermissions = file => {
80
98
  let readableFile = false;
81
99
  try {
@@ -92,7 +110,18 @@ const fileExists = path => {
92
110
  };
93
111
  const fileIsEmpty = path => {
94
112
  if (fileExists(path) && checkFilePermissions(path)) {
95
- return fs.readFileSync(path).length === 0;
113
+ try {
114
+ return fs.readFileSync(path).length === 0;
115
+ }
116
+ catch (e) {
117
+ if (e.message.toString().includes('illegal operation on a directory, read')) {
118
+ console.log('file provided cannot be a directory');
119
+ }
120
+ else {
121
+ console.log(e.message.toString());
122
+ }
123
+ process.exit(0);
124
+ }
96
125
  }
97
126
  return false;
98
127
  };
@@ -106,5 +135,6 @@ module.exports = {
106
135
  findFilesGo,
107
136
  findFilesPhp,
108
137
  findFilesRuby,
138
+ findFilesDotNet,
109
139
  fileIsEmpty
110
140
  };
@@ -25,8 +25,9 @@ function formatScanOutput(scanResults) {
25
25
  console.log(chalk_1.default.bold(message));
26
26
  console.log();
27
27
  let defaultView = getDefaultView(scanResultsInstances.content);
28
- let count = defaultView.length;
28
+ let count = 0;
29
29
  defaultView.forEach(entry => {
30
+ count++;
30
31
  let table = new cli_table3_1.default({
31
32
  chars: {
32
33
  top: '',
@@ -84,7 +85,6 @@ function formatScanOutput(scanResults) {
84
85
  ];
85
86
  table.push(learnRow);
86
87
  }
87
- count--;
88
88
  console.log(table.toString());
89
89
  console.log();
90
90
  });
@@ -149,7 +149,7 @@ function getDefaultView(content) {
149
149
  groupTypeResults.push(groupResultsObj);
150
150
  assignBySeverity(resultEntry, groupResultsObj);
151
151
  });
152
- return (0, lodash_1.sortBy)(groupTypeResults, ['priority']).reverse();
152
+ return (0, lodash_1.sortBy)(groupTypeResults, ['priority']);
153
153
  }
154
154
  exports.getDefaultView = getDefaultView;
155
155
  function editVulName(message) {
@@ -3,7 +3,7 @@ const paramHandler = require('../utils/paramsUtil/paramHandler');
3
3
  const constants = require('../../src/constants.js');
4
4
  const parsedCLIOptions = require('../../src/utils/parsedCLIOptions');
5
5
  const path = require('path');
6
- const { supportedLanguages } = require('../audit/languageAnalysisEngine/constants');
6
+ const { supportedLanguagesScan } = require('../constants/constants');
7
7
  const i18n = require('i18n');
8
8
  const { scanUsageGuide } = require('./help');
9
9
  const getScanConfig = argv => {
@@ -15,7 +15,7 @@ const getScanConfig = argv => {
15
15
  const paramsAuth = paramHandler.getAuth(scanParams);
16
16
  if (scanParams.language) {
17
17
  scanParams.language = scanParams.language.toUpperCase();
18
- if (!Object.values(supportedLanguages).includes(scanParams.language)) {
18
+ if (!Object.values(supportedLanguagesScan).includes(scanParams.language)) {
19
19
  console.log(`Did not recognise --language ${scanParams.language}`);
20
20
  console.log(i18n.__('constantsHowToRunDev3'));
21
21
  process.exit(1);
@@ -18,7 +18,7 @@ const handleResponseErrors = (res, api) => {
18
18
  maxAppError();
19
19
  }
20
20
  else {
21
- genericError();
21
+ genericError(res);
22
22
  }
23
23
  };
24
24
  const getProtocol = host => {
@@ -1,5 +1,6 @@
1
1
  "use strict";
2
2
  const path = require('path');
3
+ const child_process = require('child_process');
3
4
  function resolveFilePath(filepath) {
4
5
  if (filepath[0] === '~') {
5
6
  return path.join(process.env.HOME, filepath.slice(1));
@@ -7,11 +8,15 @@ function resolveFilePath(filepath) {
7
8
  return filepath;
8
9
  }
9
10
  const returnProjectPath = () => {
10
- if (process.env.PWD !== (undefined || null || 'undefined')) {
11
+ if (process.platform == 'win32') {
12
+ let winPath = child_process.execSync('cd').toString();
13
+ return winPath.replace(/\//g, '\\').trim();
14
+ }
15
+ else if (process.env.PWD !== (undefined || null || 'undefined')) {
11
16
  return process.env.PWD;
12
17
  }
13
18
  else {
14
- return process.argv[process.argv.indexOf('--project_path') + 1];
19
+ return process.argv[process.argv.indexOf('--file') + 1];
15
20
  }
16
21
  };
17
22
  module.exports = {