@contrast/contrast 1.0.8 → 1.0.11

package/src/scan/autoDetection.js

@@ -1,7 +1,7 @@
 const i18n = require('i18n')
 const fileFinder = require('./fileUtils')
-const languageResolver = require('../audit/languageAnalysisEngine/reduceIdentifiedLanguages')
 const rootFile = require('../audit/languageAnalysisEngine/getProjectRootFilenames')
+const path = require('path')
 
 const autoDetectFileAndLanguage = async configToUse => {
   const entries = await fileFinder.findFile()
@@ -28,36 +28,24 @@ const autoDetectFileAndLanguage = async configToUse => {
   }
 }
 
-const autoDetectAuditFilesAndLanguages = async () => {
+const autoDetectAuditFilesAndLanguages = async filePath => {
   let languagesFound = []
-  console.log(i18n.__('searchingAuditFileDirectory', process.cwd()))
 
-  await fileFinder.findFilesJava(languagesFound)
-  await fileFinder.findFilesJavascript(languagesFound)
-  await fileFinder.findFilesPython(languagesFound)
-  await fileFinder.findFilesGo(languagesFound)
-  await fileFinder.findFilesPhp(languagesFound)
-  await fileFinder.findFilesRuby(languagesFound)
+  console.log(i18n.__('searchingAuditFileDirectory', filePath))
 
-  if (languagesFound.length === 1) {
+  await fileFinder.findFilesJava(languagesFound, filePath)
+  await fileFinder.findFilesJavascript(languagesFound, filePath)
+  await fileFinder.findFilesPython(languagesFound, filePath)
+  await fileFinder.findFilesGo(languagesFound, filePath)
+  await fileFinder.findFilesPhp(languagesFound, filePath)
+  await fileFinder.findFilesRuby(languagesFound, filePath)
+  await fileFinder.findFilesDotNet(languagesFound, filePath)
+
+  if (languagesFound) {
     return languagesFound
-  } else {
-    console.log(
-      'found multiple languages, please specify one using --file to run SCA audit'
-    )
   }
-}
 
-const manualDetectAuditFilesAndLanguages = file => {
-  let projectRootFilenames = rootFile.getProjectRootFilenames(file)
-  let identifiedLanguages =
-    languageResolver.deduceLanguageScaAnalysis(projectRootFilenames)
-
-  if (Object.keys(identifiedLanguages).length === 0) {
-    console.log(i18n.__('languageAnalysisNoLanguage', file))
-    return []
-  }
-  return [identifiedLanguages]
+  return []
 }
 
 const hasWhiteSpace = s => {
@@ -100,6 +88,5 @@ module.exports = {
   autoDetectFileAndLanguage,
   errorOnFileDetection,
   autoDetectAuditFilesAndLanguages,
-  errorOnAuditFileDetection,
-  manualDetectAuditFilesAndLanguages
+  errorOnAuditFileDetection
 }

package/src/scan/fileUtils.js

@@ -11,13 +11,14 @@ const findFile = async () => {
   })
 }
 
-const findFilesJava = async languagesFound => {
+const findFilesJava = async (languagesFound, filePath) => {
   const result = await fg(
     ['**/pom.xml', '**/build.gradle', '**/build.gradle.kts'],
     {
       dot: false,
       deep: 1,
-      onlyFiles: true
+      onlyFiles: true,
+      cwd: filePath ? filePath : process.cwd()
     }
   )
 
@@ -27,13 +28,14 @@ const findFilesJava = async languagesFound => {
   return languagesFound
 }
 
-const findFilesJavascript = async languagesFound => {
+const findFilesJavascript = async (languagesFound, filePath) => {
   const result = await fg(
     ['**/package.json', '**/yarn.lock', '**/package-lock.json'],
     {
       dot: false,
       deep: 1,
-      onlyFiles: true
+      onlyFiles: true,
+      cwd: filePath ? filePath : process.cwd()
     }
   )
 
@@ -43,11 +45,12 @@ const findFilesJavascript = async languagesFound => {
   return languagesFound
 }
 
-const findFilesPython = async languagesFound => {
+const findFilesPython = async (languagesFound, filePath) => {
   const result = await fg(['**/Pipfile.lock', '**/Pipfile'], {
     dot: false,
     deep: 3,
-    onlyFiles: true
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
@@ -56,11 +59,12 @@ const findFilesPython = async languagesFound => {
   return languagesFound
 }
 
-const findFilesGo = async languagesFound => {
+const findFilesGo = async (languagesFound, filePath) => {
   const result = await fg(['**/go.mod'], {
     dot: false,
     deep: 3,
-    onlyFiles: true
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
@@ -69,11 +73,12 @@ const findFilesGo = async languagesFound => {
   return languagesFound
 }
 
-const findFilesRuby = async languagesFound => {
+const findFilesRuby = async (languagesFound, filePath) => {
   const result = await fg(['**/Gemfile', '**/Gemfile.lock'], {
     dot: false,
     deep: 3,
-    onlyFiles: true
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
@@ -82,11 +87,12 @@ const findFilesRuby = async languagesFound => {
   return languagesFound
 }
 
-const findFilesPhp = async languagesFound => {
+const findFilesPhp = async (languagesFound, filePath) => {
   const result = await fg(['**/composer.json', '**/composer.lock'], {
     dot: false,
     deep: 3,
-    onlyFiles: true
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
@@ -95,6 +101,20 @@ const findFilesPhp = async languagesFound => {
   return languagesFound
 }
 
+const findFilesDotNet = async (languagesFound, filePath) => {
+  const result = await fg(['**/*.csproj', '**/packages.lock.json'], {
+    dot: false,
+    deep: 3,
+    onlyFiles: true,
+    cwd: filePath ? filePath : process.cwd()
+  })
+
+  if (result.length > 0) {
+    return languagesFound.push({ DOTNET: result })
+  }
+  return languagesFound
+}
+
 const checkFilePermissions = file => {
   let readableFile = false
   try {
@@ -138,5 +158,6 @@ module.exports = {
   findFilesGo,
   findFilesPhp,
   findFilesRuby,
+  findFilesDotNet,
   fileIsEmpty
 }

package/src/scan/formatScanOutput.ts

@@ -34,8 +34,9 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
 
     let defaultView = getDefaultView(scanResultsInstances.content)
 
-    let count = defaultView.length
+    let count = 0
     defaultView.forEach(entry => {
+      count++
       let table = new Table({
         chars: {
           top: '',
@@ -61,12 +62,12 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
       })
       let learnRow: string[] = []
       let adviceRow = []
+      const headerColour = chalk.hex(entry.colour)
       const headerRow = [
-        chalk
-          .hex(entry.colour)
-          .bold(`CONTRAST-${count.toString().padStart(3, '0')}`),
-        chalk.hex(entry.colour).bold('-'),
-        chalk.hex(entry.colour).bold(`[${entry.severity}] ${entry.ruleId}`) +
+        headerColour(`CONTRAST-${count.toString().padStart(3, '0')}`),
+        headerColour(`-`),
+        headerColour(`[${entry.severity}] `) +
+          headerColour.bold(`${entry.ruleId}`) +
           entry.message
       ]
 
@@ -98,12 +99,13 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
         ]
         table.push(learnRow)
       }
-      count--
       console.log(table.toString())
       console.log()
     })
   }
   printVulnInfo(projectOverview)
+
+  return projectOverview
 }
 
 function printVulnInfo(projectOverview: any) {
@@ -179,7 +181,7 @@ export function getDefaultView(content: ResultContent[]) {
     assignBySeverity(resultEntry, groupResultsObj)
   })
 
-  return sortBy(groupTypeResults, ['priority']).reverse()
+  return sortBy(groupTypeResults, ['priority'])
 }
 export function editVulName(message: string) {
   return message.substring(message.indexOf(' in '))

package/src/scan/populateProjectIdAndProjectName.js

@@ -28,7 +28,11 @@ const createProjectId = async (config, client) => {
         process.exit(1)
         return
       }
-
+      if (res.statusCode === 429) {
+        console.log(i18n.__('exceededFreeTier'))
+        process.exit(1)
+        return
+      }
       if (res.statusCode === 201) {
         console.log(i18n.__('projectCreatedScan'))
         if (config.verbose) {

package/src/scan/scan.ts

@@ -47,6 +47,10 @@ export const sendScan = async (config: any) => {
             )
             console.log(i18n.__('genericServiceError', res.statusCode))
           }
+          if (res.statusCode === 429) {
+            console.log(i18n.__('exceededFreeTier'))
+            process.exit(1)
+          }
           if (res.statusCode === 403) {
             console.log(i18n.__('permissionsError'))
             process.exit(1)

package/src/scan/scanConfig.js

@@ -1,15 +1,15 @@
 const paramHandler = require('../utils/paramsUtil/paramHandler')
 const constants = require('../../src/constants.js')
-const parsedCLIOptions = require('../../src/utils/parsedCLIOptions')
 const path = require('path')
-const {
-  supportedLanguages
-} = require('../audit/languageAnalysisEngine/constants')
+const { supportedLanguagesScan } = require('../constants/constants')
 const i18n = require('i18n')
 const { scanUsageGuide } = require('./help')
+const parsedCLIOptions = require('../utils/parsedCLIOptions')
 
-const getScanConfig = argv => {
-  let scanParams = parsedCLIOptions.getCommandLineArgsCustom(
+const getScanConfig = async (contrastConf, command, argv) => {
+  let scanParams = await parsedCLIOptions.getCommandLineArgsCustom(
+    contrastConf,
+    command,
     argv,
     constants.commandLineDefinitions.scanOptionDefinitions
   )
@@ -23,7 +23,7 @@ const getScanConfig = argv => {
 
   if (scanParams.language) {
     scanParams.language = scanParams.language.toUpperCase()
-    if (!Object.values(supportedLanguages).includes(scanParams.language)) {
+    if (!Object.values(supportedLanguagesScan).includes(scanParams.language)) {
       console.log(`Did not recognise --language ${scanParams.language}`)
       console.log(i18n.__('constantsHowToRunDev3'))
       process.exit(1)

package/src/scan/scanResults.js

@@ -4,11 +4,15 @@ const oraFunctions = require('../utils/oraWrapper')
 const _ = require('lodash')
 const i18n = require('i18n')
 const oraWrapper = require('../utils/oraWrapper')
+const readLine = require('readline')
 
 const getScanId = async (config, codeArtifactId, client) => {
   return client
     .getScanId(config, codeArtifactId)
     .then(res => {
+      if (res.statusCode == 429) {
+        throw new Error(i18n.__('exceededFreeTier'))
+      }
       return res.body.id
     })
     .catch(err => {
@@ -88,13 +92,51 @@ const returnScanResults = async (
           startScanSpinner,
           'Contrast Scan timed out at the specified ' + timeout + ' seconds.'
         )
-        console.log('Please try again, allowing more time.')
-        process.exit(1)
+
+        if (!config.isCI) {
+          const retry = await retryScanPrompt()
+          timeout = retry.timeout
+        }
       }
     }
   }
 }
 
+const retryScanPrompt = async () => {
+  const rl = readLine.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  })
+
+  return new Promise((resolve, reject) => {
+    requestUtils.timeOutError(30000, reject)
+
+    rl.question(
+      '🔁 Do you want to continue waiting on Scan? [Y/N]\n',
+      async input => {
+        if (input.toLowerCase() === 'yes' || input.toLowerCase() === 'y') {
+          console.log('Continuing wait for Scan')
+          rl.close()
+          resolve({ timeout: 300 })
+        } else if (
+          input.toLowerCase() === 'no' ||
+          input.toLowerCase() === 'n'
+        ) {
+          rl.close()
+          console.log('Contrast Scan Retry Cancelled: Exiting')
+          resolve(process.exit(1))
+        } else {
+          rl.close()
+          console.log('Invalid Input: Exiting')
+          resolve(process.exit(1))
+        }
+      }
+    )
+  }).catch(e => {
+    throw e
+  })
+}
+
 const returnScanResultsInstances = async (config, scanId) => {
   const client = commonApi.getHttpClient(config)
   let result
@@ -118,5 +160,6 @@ module.exports = {
   getScanId: getScanId,
   returnScanResults: returnScanResults,
   pollScanResults: pollScanResults,
-  returnScanResultsInstances: returnScanResultsInstances
+  returnScanResultsInstances: returnScanResultsInstances,
+  retryScanPrompt
 }

package/src/telemetry/telemetry.ts

@@ -0,0 +1,154 @@
+import { getHttpClient } from '../utils/commonApi'
+import * as crypto from 'crypto'
+import { ContrastConf } from '../utils/getConfig'
+
+export const TELEMETRY_CLI_COMMANDS_EVENT = 'CLI_COMMANDS'
+export const TELEMETRY_CLI_TIME_TO_AUTH_EVENT = 'CLI_TIME_TO_AUTH'
+
+export const sendTelemetryConfigAsConfObj = async (
+  config: ContrastConf,
+  command: string,
+  argv: string[],
+  result: string,
+  language: string
+) => {
+  const hostParam = '--host'
+  const hostParamAlias = '-h'
+  const orgIdParam = '--organization-id'
+  const orgIdParamAlias = '-o'
+  const authParam = '--authorization'
+  const apiKeyParam = '--api-key'
+
+  let configToUse
+
+  if (
+    paramExists(argv, hostParam, hostParamAlias) &&
+    paramExists(argv, orgIdParam, orgIdParamAlias) &&
+    paramExists(argv, authParam, null) &&
+    paramExists(argv, apiKeyParam, null)
+  ) {
+    //if the user has passed the values as params
+    configToUse = {
+      host: findParamValueFromArgs(argv, hostParam, hostParamAlias),
+      organizationId: findParamValueFromArgs(argv, orgIdParam, orgIdParamAlias),
+      authorization: findParamValueFromArgs(argv, authParam, null),
+      apiKey: findParamValueFromArgs(argv, apiKeyParam, null)
+    }
+  } else if (
+    config &&
+    config.get('host') &&
+    config.get('organizationId') &&
+    config.get('authorization') &&
+    config.get('apiKey')
+  ) {
+    configToUse = {
+      host: config.get('host')?.slice(0, -1), //slice off extra / in url, will 404 on teamserver if we don't
+      organizationId: config.get('organizationId'),
+      authorization: config.get('authorization'),
+      apiKey: config.get('apiKey')
+    }
+  } else {
+    //return when unable to get config
+    return
+  }
+
+  return await sendTelemetryConfigAsObject(
+    configToUse,
+    command,
+    argv,
+    result,
+    language
+  )
+}
+
+export const sendTelemetryConfigAsObject = async (
+  config: any,
+  command: string,
+  argv: string[],
+  result: string,
+  language: string
+) => {
+  const obfuscatedParams = obfuscateParams(argv)
+
+  const requestBody = {
+    event: TELEMETRY_CLI_COMMANDS_EVENT,
+    details: {
+      ip_address: '',
+      account_name: '',
+      account_host: '',
+      company_domain: '',
+      command: `contrast ${command} ${obfuscatedParams}`,
+      app_id:
+        config && config.applicationId
+          ? sha1Base64Value(config.applicationId)
+          : 'undefined',
+      project_id:
+        config && config.projectId
+          ? sha1Base64Value(config.projectId)
+          : 'undefined',
+      language: language,
+      result: result,
+      additional_info: '',
+      timestamp: new Date().toUTCString()
+    }
+  }
+
+  return await sendTelemetryRequest(config, requestBody)
+}
+
+export const sendTelemetryRequest = async (config: any, requestBody: any) => {
+  const client = getHttpClient(config)
+  return client
+    .postTelemetry(config, requestBody)
+    .then((res: any) => {
+      if (res.statusCode !== 200 && config.debug === true) {
+        console.log('Telemetry failed to send with status', res.statusCode)
+      }
+      return { statusCode: res.statusCode, statusMessage: res.statusMessage }
+    })
+    .catch((err: any) => {
+      return
+    })
+}
+
+export const obfuscateParams = (argv: string[]) => {
+  return argv
+    .join(' ')
+    .replace(/--(authorization [A-Z0-9]+)/gi, '--authorization *****')
+    .replace(/-(o [A-Z0-9-]+)/gi, '-o *****')
+    .replace(/--(organization-id [A-Z0-9-]+)/gi, '--organization-id *****')
+    .replace(/--(api-key [A-Z0-9]+)/gi, '--api-key *****')
+}
+
+export const paramExists = (
+  argv: string[],
+  param: string,
+  paramAlias: string | null
+) => {
+  return argv.find((arg: string) => arg === param || arg === paramAlias)
+}
+
+export const findParamValueFromArgs = (
+  argv: string[],
+  param: string,
+  paramAlias: string | null
+) => {
+  let paramAsValue
+
+  argv.forEach((arg: string, index: number) => {
+    if (
+      arg === param ||
+      (arg === paramAlias &&
+        argv[index + 1] !== undefined &&
+        argv[index + 1] !== null)
+    ) {
+      paramAsValue = argv[index + 1]
+    }
+  })
+
+  return paramAsValue
+}
+
+export const sha1Base64Value = (value: any) => {
+  return crypto.createHash('sha1').update(value).digest('base64')
+}

package/src/utils/commonApi.js

@@ -20,7 +20,7 @@ const handleResponseErrors = (res, api) => {
   } else if (res.statusCode === 412) {
     maxAppError()
   } else {
-    genericError()
+    genericError(res)
   }
 }
 

package/src/utils/getConfig.ts

@@ -7,7 +7,7 @@ type ContrastConfOptions = Partial<{
   orgId: string
   authHeader: string
   numOfRuns: number
-  updateMessageHidden: boolean
+  isCI: boolean
 }>
 
 type ContrastConf = Conf<ContrastConfOptions>
@@ -18,12 +18,10 @@ const localConfig = (name: string, version: string) => {
   })
   config.set('version', version)
 
-  if (process.env.CONTRAST_CODSEC_DISABLE_UPDATE_MESSAGE) {
+  if (process.env.CONTRAST_CODSEC_CI) {
     config.set(
-      'updateMessageHidden',
-      JSON.parse(
-        process.env.CONTRAST_CODSEC_DISABLE_UPDATE_MESSAGE.toLowerCase()
-      )
+      'isCI',
+      JSON.parse(process.env.CONTRAST_CODSEC_CI.toLowerCase()) as boolean
     )
   }
 
@@ -33,11 +31,6 @@ const localConfig = (name: string, version: string) => {
   return config
 }
 
-const createConfigFromYaml = (yamlPath: string) => {
-  const yamlConfig = {}
-  return yamlConfig
-}
-
 const setConfigValues = (config: ContrastConf, values: ContrastConfOptions) => {
   config.set('apiKey', values.apiKey)
   config.set('organizationId', values.orgId)
@@ -45,10 +38,4 @@ const setConfigValues = (config: ContrastConf, values: ContrastConfOptions) => {
   values.host ? config.set('host', values.host) : null
 }
 
-export {
-  localConfig,
-  createConfigFromYaml,
-  setConfigValues,
-  ContrastConf,
-  ContrastConfOptions
-}
+export { localConfig, setConfigValues, ContrastConf, ContrastConfOptions }

package/src/utils/parsedCLIOptions.js

@@ -1,6 +1,12 @@
 const commandLineArgs = require('command-line-args')
+const { sendTelemetryConfigAsConfObj } = require('../telemetry/telemetry')
 
-const getCommandLineArgsCustom = (parameterList, optionDefinitions) => {
+const getCommandLineArgsCustom = async (
+  contrastConf,
+  command,
+  parameterList,
+  optionDefinitions
+) => {
   try {
     return commandLineArgs(optionDefinitions, {
       argv: parameterList,
@@ -9,6 +15,13 @@ const getCommandLineArgsCustom = (parameterList, optionDefinitions) => {
       caseInsensitive: true
     })
   } catch (e) {
+    await sendTelemetryConfigAsConfObj(
+      contrastConf,
+      command,
+      parameterList,
+      'FAILURE',
+      'undefined'
+    )
     console.log(e.message.toString())
     process.exit(1)
   }

package/src/utils/requestUtils.js

@@ -15,8 +15,15 @@ const sleep = ms => {
   return new Promise(resolve => setTimeout(resolve, ms))
 }
 
+const timeOutError = (ms, reject) => {
+  return setTimeout(() => {
+    reject(new Error(`No input detected after 30s`))
+  }, ms)
+}
+
 module.exports = {
   sendRequest: sendRequest,
   sleep: sleep,
-  millisToSeconds: millisToSeconds
+  millisToSeconds: millisToSeconds,
+  timeOutError: timeOutError
 }

package/dist/audit/AnalysisEngine.js

@@ -1,37 +0,0 @@
-"use strict";
-class AnalysisEngine {
-    constructor(initAnalysis = {}) {
-        this.analyzers = [];
-        this.analysis = { ...initAnalysis };
-    }
-    use(analyzer) {
-        if (Array.isArray(analyzer)) {
-            this.analyzers = [...this.analyzers, ...analyzer];
-            return;
-        }
-        this.analyzers.push(analyzer);
-    }
-    analyze(callback, config) {
-        let i = 0;
-        const next = err => {
-            if (err) {
-                return setImmediate(() => callback(err, this.analysis));
-            }
-            if (i >= this.analyzers.length) {
-                return setImmediate(() => callback(null, this.analysis));
-            }
-            const analyzer = this.analyzers[i];
-            i++;
-            setImmediate(() => {
-                try {
-                    analyzer(this.analysis, next, config);
-                }
-                catch (uncaughtErr) {
-                    next(uncaughtErr);
-                }
-            });
-        };
-        next();
-    }
-}
-module.exports = exports = AnalysisEngine;