@contrast/contrast 1.0.7 → 1.0.8

package/src/audit/languageAnalysisEngine/report/commonReportingFunctions.ts

@@ -12,7 +12,8 @@ import {
   findCVESeveritiesAndOrderByHighestPriority,
   findHighestSeverityCVE,
   findNameAndVersion,
-  severityCountAllCVEs
+  severityCountAllCVEs,
+  severityCountAllLibraries
 } from './utils/reportUtils'
 import { SeverityCountModel } from './models/severityCountModel'
 import {
@@ -20,6 +21,13 @@ import {
   ReportOutputHeaderModel,
   ReportOutputModel
 } from './models/reportOutputModel'
+import {
+  CRITICAL_COLOUR,
+  HIGH_COLOUR,
+  LOW_COLOUR,
+  MEDIUM_COLOUR,
+  NOTE_COLOUR
+} from '../../../constants/constants'
 
 export const createLibraryHeader = (
   id: string,
@@ -27,11 +35,9 @@ export const createLibraryHeader = (
   numberOfCves: number
 ) => {
   numberOfVulnerableLibraries === 1
-    ? console.log(
-        ` Found 1 vulnerable library containing ${numberOfCves} CVE's`
-      )
+    ? console.log(`Found 1 vulnerable library containing ${numberOfCves} CVEs`)
     : console.log(
-        ` Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVE's `
+        `Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVEs `
       )
 }
 
@@ -43,10 +49,6 @@ export const getReport = async (config: any, reportId: string) => {
       if (res.statusCode === 200) {
         return res.body
       } else {
-        console.log('config-------------------')
-        console.log(config)
-        console.log('reportId----------------')
-        console.log(reportId)
         console.log(JSON.stringify(res))
         handleResponseErrors(res, 'report')
       }
@@ -81,7 +83,11 @@ export const printFormattedOutput = (
       new ReportCompositeKey(
         name,
         version,
-        findHighestSeverityCVE(library.cveArray) as ReportSeverityModel
+        findHighestSeverityCVE(library.cveArray) as ReportSeverityModel,
+        severityCountAllCVEs(
+          library.cveArray,
+          new SeverityCountModel()
+        ).getTotal
       ),
       library.cveArray
     )
@@ -89,15 +95,23 @@ export const printFormattedOutput = (
     report.reportOutputList.push(newOutputModel)
   }
 
-  const orderedOutputListLowestFirst = orderBy(
+  const outputOrderedByLowestSeverityAndLowestNumOfCvesFirst = orderBy(
     report.reportOutputList,
-    reportListItem => reportListItem.compositeKey.highestSeverity.priority,
+    [
+      (reportListItem: ReportModelStructure) => {
+        return reportListItem.compositeKey.highestSeverity.priority
+      },
+      (reportListItem: ReportModelStructure) => {
+        return reportListItem.compositeKey.numberOfSeverities
+      }
+    ],
     ['desc']
   )
 
-  let contrastHeaderNumCounter = 0
-  for (const reportModel of orderedOutputListLowestFirst) {
-    contrastHeaderNumCounter++
+  let contrastHeaderNumCounter =
+    outputOrderedByLowestSeverityAndLowestNumOfCvesFirst.length + 1
+  for (const reportModel of outputOrderedByLowestSeverityAndLowestNumOfCvesFirst) {
+    contrastHeaderNumCounter--
     const { libraryName, libraryVersion, highestSeverity } =
       reportModel.compositeKey
     const numOfCVEs = reportModel.cveArray.length
@@ -118,7 +132,22 @@ export const printFormattedOutput = (
       reportOutputModel.header.introducesMessage
     )
     console.log(reportOutputModel.body.issueMessage)
-    console.log(reportOutputModel.body.adviceMessage)
+    console.log(reportOutputModel.body.adviceMessage + '\n')
+  }
+
+  const {
+    criticalMessage,
+    highMessage,
+    mediumMessage,
+    lowMessage,
+    noteMessage,
+    total
+  } = buildFooter(libraries)
+
+  if (total > 1) {
+    console.log(
+      `${criticalMessage} | ${highMessage} | ${mediumMessage} | ${lowMessage} | ${noteMessage}`
+    )
   }
 }
 
@@ -130,7 +159,7 @@ export function buildHeader(
   numOfCVEs: number
 ) {
   const vulnerabilityPluralised =
-    numOfCVEs > 1 ? 'Vulnerabilities' : 'Vulnerability'
+    numOfCVEs > 1 ? 'vulnerabilities' : 'vulnerability'
   const formattedHeaderNum = buildFormattedHeaderNum(contrastHeaderNum)
 
   const vulnMessage = chalk
@@ -176,6 +205,27 @@ export function buildBody(cveArray: ReportCVEModel[]) {
   return new ReportOutputBodyModel(issueMessage, adviceMessage)
 }
 
+const buildFooter = (libraries: ReportLibraryModel[]) => {
+  const { critical, high, medium, low, note, getTotal } =
+    severityCountAllLibraries(libraries)
+  const criticalMessage = chalk
+    .hex(CRITICAL_COLOUR)
+    .bold(`${critical} Critical`)
+  const highMessage = chalk.hex(HIGH_COLOUR).bold(`${high} High`)
+  const mediumMessage = chalk.hex(MEDIUM_COLOUR).bold(`${medium} Medium`)
+  const lowMessage = chalk.hex(LOW_COLOUR).bold(`${low} Low`)
+  const noteMessage = chalk.hex(NOTE_COLOUR).bold(`${note} Note`)
+
+  return {
+    criticalMessage,
+    highMessage,
+    mediumMessage,
+    lowMessage,
+    noteMessage,
+    total: getTotal
+  }
+}
+
 export function buildFormattedHeaderNum(contrastHeaderNum: number) {
   let formattedHeaderNum
 

package/src/audit/languageAnalysisEngine/report/models/reportListModel.ts

@@ -23,14 +23,17 @@ export class ReportCompositeKey {
   libraryName!: string
   libraryVersion!: string
   highestSeverity!: ReportSeverityModel
+  numberOfSeverities!: number
 
   constructor(
     libraryName: string,
     libraryVersion: string,
-    highestSeverity: ReportSeverityModel
+    highestSeverity: ReportSeverityModel,
+    numberOfSeverities: number
   ) {
     this.libraryName = libraryName
     this.libraryVersion = libraryVersion
     this.highestSeverity = highestSeverity
+    this.numberOfSeverities = numberOfSeverities
   }
 }

package/src/audit/languageAnalysisEngine/report/models/severityCountModel.ts

@@ -13,4 +13,8 @@ export class SeverityCountModel {
     this.low = 0
     this.note = 0
   }
+
+  get getTotal(): number {
+    return this.critical + this.high + this.medium + this.low + this.note
+  }
 }

package/src/audit/languageAnalysisEngine/report/reportingFeature.ts

@@ -4,9 +4,11 @@ import {
   printVulnerabilityResponse
 } from './commonReportingFunctions'
 import {
-  convertGenericToTypedLibraries,
+  convertGenericToTypedLibraryVulns,
   severityCountAllLibraries
 } from './utils/reportUtils'
+import i18n from 'i18n'
+import chalk from 'chalk'
 
 export async function vulnerabilityReport(
   analysis: any,
@@ -17,11 +19,9 @@ export async function vulnerabilityReport(
 
   if (reportResponse !== undefined) {
     const id = applicationId
-    const name = analysis.config.applicationName
     formatVulnerabilityOutput(
       reportResponse.vulnerabilities,
       id,
-      name,
       analysis.config
     )
   }
@@ -30,27 +30,59 @@ export async function vulnerabilityReport(
 export function formatVulnerabilityOutput(
   libraryVulnerabilityResponse: any,
   id: string,
-  name: string,
   config: any
 ) {
-  const vulnerableLibraries = convertGenericToTypedLibraries(
+  const vulnerableLibraries = convertGenericToTypedLibraryVulns(
     libraryVulnerabilityResponse
   )
 
   const numberOfVulnerableLibraries = vulnerableLibraries.length
-  let numberOfCves = 0
-  vulnerableLibraries.forEach(lib => (numberOfCves += lib.cveArray.length))
 
-  createLibraryHeader(id, numberOfVulnerableLibraries, numberOfCves)
+  if (numberOfVulnerableLibraries === 0) {
+    console.log(i18n.__('scanNoVulnerabilitiesFound'))
+    console.log(i18n.__('scanNoVulnerabilitiesFoundSecureCode'))
+    console.log(i18n.__('scanNoVulnerabilitiesFoundGoodWork'))
+    console.log(
+      chalk.bold(`Found ${numberOfVulnerableLibraries} vulnerabilities`)
+    )
+    console.log(
+      i18n.__(
+        'foundDetailedVulnerabilities',
+        String(0),
+        String(0),
+        String(0),
+        String(0),
+        String(0)
+      )
+    )
+  } else {
+    let numberOfCves = 0
+    vulnerableLibraries.forEach(lib => (numberOfCves += lib.cveArray.length))
 
-  const hasSomeVulnerabilitiesReported = printVulnerabilityResponse(
-    vulnerableLibraries,
-    config
-  )
+    createLibraryHeader(id, numberOfVulnerableLibraries, numberOfCves)
+
+    const hasSomeVulnerabilitiesReported = printVulnerabilityResponse(
+      vulnerableLibraries,
+      config
+    )
+
+    return [
+      hasSomeVulnerabilitiesReported,
+      numberOfCves,
+      severityCountAllLibraries(vulnerableLibraries)
+    ]
+  }
+}
+
+export async function vulnerabilityReportV2(config: any, reportId: string) {
+  const reportResponse = await getReport(config, reportId)
 
-  return [
-    hasSomeVulnerabilitiesReported,
-    numberOfCves,
-    severityCountAllLibraries(vulnerableLibraries)
-  ]
+  if (reportResponse !== undefined) {
+    const name = config.applicationName
+    formatVulnerabilityOutput(
+      reportResponse.vulnerabilities,
+      config.applicationId,
+      config
+    )
+  }
 }

package/src/audit/languageAnalysisEngine/report/utils/reportUtils.ts

@@ -67,7 +67,7 @@ export function findCVESeverity(cve: ReportCVEModel) {
   }
 }
 
-export function convertGenericToTypedLibraries(libraries: any) {
+export function convertGenericToTypedLibraryVulns(libraries: any) {
   return Object.entries(libraries).map(([name, cveArray]) => {
     return new ReportLibraryModel(name, cveArray as ReportCVEModel[])
   })

package/src/audit/save.js

@@ -0,0 +1,32 @@
+const fs = require('fs')
+const i18n = require('i18n')
+const chalk = require('chalk')
+const save = require('../commands/audit/saveFile')
+const sbom = require('../sbom/generateSbom')
+
+async function auditSave(config) {
+  if (config.save) {
+    if (config.save.toLowerCase() === 'sbom') {
+      save.saveFile(config, await sbom.generateSbom(config))
+
+      const filename = `${config.applicationId}-sbom-cyclonedx.json`
+      if (fs.existsSync(filename)) {
+        console.log(i18n.__('auditSBOMSaveSuccess') + ` - ${filename}`)
+      } else {
+        console.log(
+          chalk.yellow.bold(
+            `\n Unable to save ${filename} Software Bill of Materials (SBOM)`
+          )
+        )
+      }
+    } else {
+      console.log(i18n.__('auditBadFiletypeSpecifiedForSave'))
+    }
+  } else if (config.save === null) {
+    console.log(i18n.__('auditNoFiletypeSpecifiedForSave'))
+  }
+}
+
+module.exports = {
+  auditSave
+}

package/src/commands/audit/auditController.ts

@@ -3,7 +3,6 @@ import commonApi from '../../audit/languageAnalysisEngine/commonApi'
 
 const identifyLanguageAE = require('./../../audit/languageAnalysisEngine')
 const languageFactory = require('../../audit/languageAnalysisEngine/languageAnalysisFactory')
-const { v4: uuidv4 } = require('uuid')
 
 export const dealWithNoAppId = async (config: { [x: string]: string }) => {
   let appID: string
@@ -14,14 +13,15 @@ export const dealWithNoAppId = async (config: { [x: string]: string }) => {
       return await catalogueApplication(config)
     }
     if (!appID && !config.applicationName) {
-      config.applicationName = uuidv4()
-      return await catalogueApplication(config)
+      config.applicationName = getAppName(config.file) as string
+      // @ts-ignore
+      appID = await commonApi.returnAppId(config)
+      if (!appID) {
+        return await catalogueApplication(config)
+      }
     }
-    // @ts-ignore
-  } catch (e) {
-    // @ts-ignore
+  } catch (e: any) {
     if (e.toString().includes('tunneling socket could not be established')) {
-      // @ts-ignore
       console.log(e.message.toString())
       console.log(
         'There seems to be an issue with your proxy, please check and try again'
@@ -37,10 +37,19 @@ export const startAudit = async (config: { [key: string]: string }) => {
     // @ts-ignore
     config.applicationId = await dealWithNoAppId(config)
   }
-  identifyLanguageAE(
-    config.projectPath,
-    languageFactory,
-    config.applicationId,
-    config
-  )
+  identifyLanguageAE(config.file, languageFactory, config.applicationId, config)
+}
+
+export const getAppName = (file: string) => {
+  const last = file.charAt(file.length - 1)
+  if (last !== '/') {
+    return file.split('/').pop()
+  } else {
+    const str = removeLastChar(file)
+    return str.split('/').pop()
+  }
+}
+
+const removeLastChar = (str: string) => {
+  return str.substring(0, str.length - 1)
 }

package/src/commands/audit/help.ts

@@ -41,7 +41,30 @@ const auditUsageGuide = commandLineUsage([
   },
   {
     header: i18n.__('constantsAuditOptions'),
-    optionList: constants.commandLineDefinitions.auditOptionDefinitions
+    optionList: constants.commandLineDefinitions.auditOptionDefinitions,
+    hide: [
+      'application-id',
+      'application-name',
+      'organization-id',
+      'api-key',
+      'authorization',
+      'host',
+      'proxy',
+      'help',
+      'ff',
+      'ignore-cert-errors',
+      'verbose',
+      'debug',
+      'experimental',
+      'tags',
+      'sub-project',
+      'code',
+      'maven-settings-path',
+      'language',
+      'experimental',
+      'app-groups',
+      'metadata'
+    ]
   }
 ])
 

package/src/commands/audit/processAudit.ts

@@ -1,6 +1,7 @@
 import { startAudit } from './auditController'
 import { getAuditConfig } from './auditConfig'
 import { auditUsageGuide } from './help'
+import { processSca } from '../scan/sca/scaAnalysis'
 
 export type parameterInput = string[]
 
@@ -11,9 +12,11 @@ export const processAudit = async (argv: parameterInput) => {
   }
   const config = getAuditConfig(argv)
 
-  // console.log(config)
-
-  const auditResults = await startAudit(config)
+  if (config.experimental) {
+    await processSca(config)
+  } else {
+    await startAudit(config)
+  }
 }
 
 const printHelpMessage = () => {

package/src/commands/audit/saveFile.ts

@@ -1,6 +1,10 @@
 import fs from 'fs'
 
-export default function saveFile(config: any, rawResults: any) {
+export const saveFile = (config: any, rawResults: any) => {
   const fileName = `${config.applicationId}-sbom-cyclonedx.json`
   fs.writeFileSync(fileName, JSON.stringify(rawResults))
 }
+
+module.exports = {
+  saveFile
+}

package/src/commands/scan/sca/scaAnalysis.js

@@ -6,19 +6,35 @@ const {
 } = require('../../../scan/autoDetection')
 const auditController = require('../../audit/auditController')
 const {
-  supportedLanguages: { JAVA, GO, RUBY, PYTHON }
+  supportedLanguages: { JAVA, GO, PYTHON, RUBY, JAVASCRIPT, NODE, PHP }
 } = require('../../../audit/languageAnalysisEngine/constants')
 const goAnalysis = require('../../../scaAnalysis/go/goAnalysis')
+const phpAnalysis = require('../../../scaAnalysis/php/index')
 const { rubyAnalysis } = require('../../../scaAnalysis/ruby')
 const { pythonAnalysis } = require('../../../scaAnalysis/python')
+const javascriptAnalysis = require('../../../scaAnalysis/javascript')
+const {
+  pollForSnapshotCompletition
+} = require('../../../audit/languageAnalysisEngine/sendSnapshot')
+const {
+  returnOra,
+  startSpinner,
+  succeedSpinner
+} = require('../../../utils/oraWrapper')
+const i18n = require('i18n')
+const {
+  vulnerabilityReportV2
+} = require('../../../audit/languageAnalysisEngine/report/reportingFeature')
+const auditSave = require('../../../audit/save')
 
 const processSca = async config => {
   let filesFound
-  if (config.projectPath) {
-    filesFound = manualDetectAuditFilesAndLanguages(config.projectPath)
+  if (config.file) {
+    config.file = config.file.concat('/')
+    filesFound = await manualDetectAuditFilesAndLanguages(config.file)
   } else {
     filesFound = await autoDetection.autoDetectAuditFilesAndLanguages(config)
-    config.projectPath = process.cwd()
+    config.file = process.cwd().concat('/')
   }
 
   // files found looks like [ { javascript: [ Array ] } ]
@@ -31,26 +47,25 @@ const processSca = async config => {
         messageToSend = javaAnalysis.javaAnalysis(config, filesFound[0])
         config.language = JAVA
         break
-      // case 'javascript':
-      //     // code block
-      //     break;
-      // case 'dotnet':
-      //     // code block
-      //     break;
-      case RUBY:
-        messageToSend = rubyAnalysis(config, filesFound[0])
-        config.language = RUBY
+      case JAVASCRIPT:
+        messageToSend = await javascriptAnalysis.jsAnalysis(
+          config,
+          filesFound[0]
+        )
+        config.language = NODE
         break
       case PYTHON:
         messageToSend = pythonAnalysis(config, filesFound[0])
         config.language = PYTHON
         break
-      // case 'ruby':
-      //     // code block
-      //     break;
-      // case 'php':
-      //     // code block
-      //     break;
+      case RUBY:
+        messageToSend = rubyAnalysis(config, filesFound[0])
+        config.language = RUBY
+        break
+      case 'PHP':
+        messageToSend = phpAnalysis.phpAnalysis(config, filesFound[0])
+        config.language = PHP
+        break
       case GO:
         messageToSend = goAnalysis.goAnalysis(config, filesFound[0])
         config.language = GO
@@ -65,14 +80,30 @@ const processSca = async config => {
       config.applicationId = await auditController.dealWithNoAppId(config)
     }
     //send message to TS
-    console.log('processing dependencies')
-    const response = await treeUpload.commonSendSnapShot(messageToSend, config)
+    const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'))
+    startSpinner(reportSpinner)
+    const snapshotResponse = await treeUpload.commonSendSnapShot(
+      messageToSend,
+      config
+    )
+
+    //poll for completion
+    await pollForSnapshotCompletition(
+      config,
+      snapshotResponse.id,
+      reportSpinner
+    )
+    succeedSpinner(reportSpinner, 'Contrast SCA audit complete')
+
+    await vulnerabilityReportV2(config, snapshotResponse.id)
+
+    await auditSave.auditSave(config)
   } else {
     if (filesFound.length === 0) {
       console.log('no compatible dependency files detected. Continuing...')
     } else {
       console.log(
-        'multiple language files detected, please use --project-path to specify a directory or the file where dependencies are declared'
+        'multiple language files detected, please use --file to specify a directory or the file where dependencies are declared'
       )
     }
   }

package/src/common/HTTPClient.js

@@ -339,6 +339,13 @@ HTTPClient.prototype.getSbom = function getSbom(config) {
   return requestUtils.sendRequest({ method: 'get', options })
 }
 
+HTTPClient.prototype.getLatestVersion = function getLatestVersion() {
+  const options = _.cloneDeep(this.requestOptions)
+  options.url =
+    'https://pkg.contrastsecurity.com/artifactory/cli/latest-version.txt'
+  return requestUtils.sendRequest({ method: 'get', options })
+}
+
 // analytics
 
 HTTPClient.prototype.postAnalyticsFunction = function (config, provider, body) {

package/src/common/versionChecker.ts

@@ -1,12 +1,31 @@
-import latestVersion from 'latest-version'
 import { APP_VERSION } from '../constants/constants'
 import boxen from 'boxen'
 import chalk from 'chalk'
 import semver from 'semver'
+import commonApi from '../utils/commonApi'
+import { constants } from 'http2'
+import { ContrastConf } from '../utils/getConfig'
 
-export async function findLatestCLIVersion(updateMessageHidden: boolean) {
-  if (!updateMessageHidden) {
-    const latestCLIVersion = await latestVersion('@contrast/contrast')
+const getLatestVersion = async (config: any) => {
+  const client = commonApi.getHttpClient(config)
+  try {
+    const res = await client.getLatestVersion()
+    if (res.statusCode === constants.HTTP_STATUS_OK) {
+      return res.body
+    }
+  } catch (e) {
+    return
+  }
+}
+
+// @ts-ignore
+export async function findLatestCLIVersion(config: ContrastConf) {
+  const messageHidden = config.get('updateMessageHidden') as boolean
+
+  if (!messageHidden) {
+    let latestCLIVersion: string = await getLatestVersion(config)
+    //strip key
+    latestCLIVersion = latestCLIVersion.substring(8)
 
     if (semver.lt(APP_VERSION, latestCLIVersion)) {
       const updateAvailableMessage = `Update available ${chalk.yellow(

package/src/constants/constants.js

@@ -13,7 +13,7 @@ const MEDIUM = 'MEDIUM'
 const HIGH = 'HIGH'
 const CRITICAL = 'CRITICAL'
 const APP_NAME = 'contrast'
-const APP_VERSION = '1.0.7'
+const APP_VERSION = '1.0.8'
 const TIMEOUT = 120000
 const HIGH_COLOUR = '#ff9900'
 const CRITICAL_COLOUR = '#e35858'