@contrast/contrast 1.0.8 → 1.0.11

package/src/scaAnalysis/common/treeUpload.js

@@ -1,29 +1,43 @@
-const { getHttpClient } = require('../../utils/commonApi')
+const commonApi = require('../../utils/commonApi')
 const { APP_VERSION } = require('../../constants/constants')
 
 const commonSendSnapShot = async (analysis, config) => {
-  const requestBody = {
-    appID: config.applicationId,
-    cliVersion: APP_VERSION,
-    snapshot: analysis
-  }
-
-  const client = getHttpClient(config)
+  let requestBody = {}
+  config.experimental === true
+    ? (requestBody = sendToSCAServices(config, analysis))
+    : (requestBody = {
+        appID: config.applicationId,
+        cliVersion: APP_VERSION,
+        snapshot: analysis
+      })
+  const client = commonApi.getHttpClient(config)
   return client
     .sendSnapshot(requestBody, config)
     .then(res => {
       if (res.statusCode === 201) {
         return res.body
       } else {
-        console.log(res.statusCode)
-        console.log('error processing dependencies')
+        throw new Error(res.statusCode + ` error processing dependencies`)
       }
     })
     .catch(err => {
-      console.log(err)
+      throw err
     })
 }
 
+const sendToSCAServices = (config, analysis) => {
+  return {
+    applicationId: config.applicationId,
+    dependencyTree: analysis,
+    organizationId: config.organizationId,
+    language: config.language,
+    tool: {
+      name: 'Contrast Codesec',
+      version: APP_VERSION
+    }
+  }
+}
+
 module.exports = {
   commonSendSnapShot
 }

package/src/scaAnalysis/dotnet/analysis.js

@@ -0,0 +1,72 @@
+const fs = require('fs')
+const xml2js = require('xml2js')
+const i18n = require('i18n')
+
+const readAndParseProjectFile = projectFilePath => {
+  const projectFile = fs.readFileSync(projectFilePath)
+
+  return new xml2js.Parser({
+    explicitArray: false,
+    mergeAttrs: true
+  }).parseString(projectFile)
+}
+
+const readAndParseLockFile = lockFilePath => {
+  const lockFile = JSON.parse(fs.readFileSync(lockFilePath).toString())
+
+  let count = 0 // Used to test if some nodes are deleted
+
+  for (const dependenciesNode in lockFile.dependencies) {
+    for (const innerNode in lockFile.dependencies[dependenciesNode]) {
+      const nodeValidation = JSON.stringify(
+        lockFile.dependencies[dependenciesNode][innerNode]
+      )
+      if (nodeValidation.includes('"type":"Project"')) {
+        count += 1
+        delete lockFile.dependencies[dependenciesNode][innerNode]
+        lockFile.additionalInfo = 'dependenciesNote'
+      }
+    }
+  }
+
+  if (count > 0) {
+    const multiLevelProjectWarning = () => {
+      console.log('')
+      console.log(i18n.__('dependenciesNote'))
+    }
+    setTimeout(multiLevelProjectWarning, 7000)
+  }
+
+  return lockFile
+}
+
+const checkForCorrectFiles = languageFiles => {
+  if (!languageFiles.includes('packages.lock.json')) {
+    throw new Error(i18n.__('languageAnalysisHasNoLockFile', '.NET'))
+  }
+
+  if (!languageFiles.some(i => i.includes('.csproj'))) {
+    throw new Error(i18n.__('languageAnalysisProjectFileError', '.NET'))
+  }
+}
+
+const getDotNetDeps = (filePath, languageFiles) => {
+  checkForCorrectFiles(languageFiles)
+  const projectFileName = languageFiles.find(fileName =>
+    fileName.includes('.csproj')
+  )
+  const lockFileName = languageFiles.find(fileName =>
+    fileName.includes('.json')
+  )
+  const projectFile = readAndParseProjectFile(filePath + `/${projectFileName}`)
+  const lockFile = readAndParseLockFile(filePath + `/${lockFileName}`)
+
+  return { projectFile, lockFile }
+}
+
+module.exports = {
+  getDotNetDeps,
+  readAndParseProjectFile,
+  readAndParseLockFile,
+  checkForCorrectFiles
+}

package/src/scaAnalysis/dotnet/index.js

@@ -0,0 +1,11 @@
+const { getDotNetDeps } = require('./analysis')
+const { createDotNetTSMessage } = require('../common/formatMessage')
+
+const dotNetAnalysis = (config, languageFiles) => {
+  const dotNetDeps = getDotNetDeps(config.file, languageFiles.DOTNET)
+  return createDotNetTSMessage(dotNetDeps)
+}
+
+module.exports = {
+  dotNetAnalysis
+}

package/src/scaAnalysis/go/goAnalysis.js

@@ -1,14 +1,21 @@
 const { createGoTSMessage } = require('../common/formatMessage')
+const {
+  parseDependenciesForSCAServices
+} = require('../common/scaParserForGoAndJava')
 const goReadDepFile = require('./goReadDepFile')
 const goParseDeps = require('./goParseDeps')
 
-const goAnalysis = (config, languageFiles) => {
+const goAnalysis = config => {
   try {
     const rawGoDependencies = goReadDepFile.getGoDependencies(config)
     const parsedGoDependencies =
       goParseDeps.parseGoDependencies(rawGoDependencies)
 
-    return createGoTSMessage(parsedGoDependencies)
+    if (config.experimental) {
+      return parseDependenciesForSCAServices(parsedGoDependencies)
+    } else {
+      return createGoTSMessage(parsedGoDependencies)
+    }
   } catch (e) {
     console.log(e.message.toString())
   }

package/src/scaAnalysis/java/analysis.js

@@ -6,9 +6,13 @@ const fs = require('fs')
 const MAVEN = 'maven'
 const GRADLE = 'gradle'
 
-const determineProjectTypeAndCwd = (files, file) => {
+const determineProjectTypeAndCwd = (files, config) => {
   const projectData = {}
 
+  if (files.length > 1) {
+    files = files.filter(i => config.fileName.includes(i))
+  }
+
   if (files[0].includes('pom.xml')) {
     projectData.projectType = MAVEN
   } else if (files[0].includes('build.gradle')) {
@@ -16,9 +20,9 @@ const determineProjectTypeAndCwd = (files, file) => {
   }
 
   //clean up the path to be a folder not a file
-  projectData.cwd = file
-    ? file.replace('pom.xml', '').replace('build.gradle', '')
-    : file
+  projectData.cwd = config.file
+    ? config.file.replace('pom.xml', '').replace('build.gradle', '')
+    : config.file
 
   return projectData
 }
@@ -124,7 +128,7 @@ const getJavaBuildDeps = (config, files) => {
   }
 
   try {
-    const projectData = determineProjectTypeAndCwd(files, config.file)
+    const projectData = determineProjectTypeAndCwd(files, config)
     if (projectData.projectType === MAVEN) {
       output.mvnDependancyTreeOutput = buildMaven(config, projectData, timeout)
     } else if (projectData.projectType === GRADLE) {
@@ -138,5 +142,6 @@ const getJavaBuildDeps = (config, files) => {
 }
 
 module.exports = {
-  getJavaBuildDeps
+  getJavaBuildDeps,
+  determineProjectTypeAndCwd
 }

package/src/scaAnalysis/java/index.js

@@ -1,6 +1,9 @@
 const analysis = require('./analysis')
 const { parseBuildDeps } = require('./javaBuildDepsParser')
 const { createJavaTSMessage } = require('../common/formatMessage')
+const {
+  parseDependenciesForSCAServices
+} = require('../common/scaParserForGoAndJava')
 
 const javaAnalysis = (config, languageFiles) => {
   languageFiles.JAVA.forEach(file => {
@@ -8,7 +11,12 @@ const javaAnalysis = (config, languageFiles) => {
   })
 
   const javaDeps = buildJavaTree(config, languageFiles.JAVA)
-  return createJavaTSMessage(javaDeps)
+
+  if (config.experimental) {
+    return parseDependenciesForSCAServices(javaDeps)
+  } else {
+    return createJavaTSMessage(javaDeps)
+  }
 }
 
 const buildJavaTree = (config, files) => {

package/src/scaAnalysis/java/javaBuildDepsParser.js

@@ -14,14 +14,14 @@ const parseBuildDeps = (config, input) => {
 const preParser = shavedOutput => {
   let obj = []
   for (let dep in shavedOutput) {
+    shavedOutput[dep] = shaveDependencyType(shavedOutput[dep])
+
     obj.push(
       shavedOutput[dep]
         .replace('+-', '+---')
         .replace('[INFO]', '')
         .replace('\\-', '\\---')
         .replace(':jar:', ':')
-        .replace(':test', '')
-        .replace(':compile', '')
         .replace(' +', '+')
         .replace(' |', '|')
         .replace(' \\', '\\')
@@ -56,11 +56,29 @@ const preParser = shavedOutput => {
   return depTree
 }
 
+const shaveDependencyType = dep => {
+  if (dep.endsWith('\r')) {
+    dep = dep.slice(0, -1)
+  }
+
+  if (dep.endsWith(':test')) {
+    dep = dep.slice(0, -5)
+  }
+
+  if (dep.endsWith(':compile')) {
+    dep = dep.slice(0, -8)
+  }
+
+  if (dep.endsWith(':provided')) {
+    dep = dep.slice(0, -9)
+  }
+
+  return dep
+}
+
 const shaveOutput = (gradleDependencyTreeOutput, projectType) => {
   let shavedOutput = gradleDependencyTreeOutput.split('\n')
 
-  // console.log(projectType)
-
   if (projectType === 'maven') {
     shavedOutput = preParser(shavedOutput)
   }
@@ -375,7 +393,6 @@ const validateIndentation = shavedOutput => {
 
 const parseGradle = (gradleDependencyTreeOutput, config, projectType) => {
   let shavedOutput = shaveOutput(gradleDependencyTreeOutput, projectType)
-
   if (config.subProject) {
     let subProject = parseSubProject(shavedOutput)
     let validatedOutput = validateIndentation(subProject)
@@ -400,5 +417,7 @@ module.exports = {
   computeRelationToLastElement,
   addIndentation,
   computeLevel,
-  computeIndentation
+  computeIndentation,
+  shaveDependencyType,
+  preParser
 }

package/src/scaAnalysis/javascript/analysis.js

@@ -12,7 +12,7 @@ const readFile = async (config, languageFiles, nameOfFile) => {
   if (config.file) {
     return fs.readFileSync(config.file.concat(languageFiles[index]), 'utf8')
   } else {
-    console.log('could not find file')
+    throw new Error('could not find file')
   }
 }
 
@@ -40,8 +40,7 @@ const readYarn = async (config, languageFiles, nameOfFile) => {
 
     return yarn
   } catch (err) {
-    console.log(i18n.__('nodeReadYarnLockFileError') + `${err.message}`)
-    return
+    throw new Error(i18n.__('nodeReadYarnLockFileError') + `${err.message}`)
   }
 }
 
@@ -80,8 +79,7 @@ const parseNpmLockFile = async js => {
       return js.npmLockFile
     }
   } catch (err) {
-    console.log(i18n.__('NodeParseNPM') + `${err.message}`)
-    return
+    throw new Error(i18n.__('NodeParseNPM') + `${err.message}`)
   }
 }
 
@@ -113,8 +111,9 @@ const parseYarnLockFile = async js => {
       return js
     }
   } catch (err) {
-    console.log(i18n.__('NodeParseYarn') + `${err.message}`)
-    return
+    throw new Error(
+      i18n.__('NodeParseYarn', js.yarn.yarnVersion) + `${err.message}`
+    )
   }
 }
 

package/src/scaAnalysis/javascript/index.js

@@ -3,12 +3,10 @@ const i18n = require('i18n')
 const formatMessage = require('../common/formatMessage')
 
 const jsAnalysis = async (config, languageFiles) => {
-  if (
-    languageFiles.JAVASCRIPT.includes('package-lock.json') &&
-    languageFiles.JAVASCRIPT.includes('yarn.lock')
-  ) {
-    console.log(i18n.__('languageAnalysisMultipleLanguages1'))
-    return
+  checkForCorrectFiles(languageFiles)
+
+  if (!config.file.endsWith('/')) {
+    config.file = config.file.concat('/')
   }
   return buildNodeTree(config, languageFiles.JAVASCRIPT)
 }
@@ -51,6 +49,27 @@ const parseFiles = async (config, files, js) => {
   return js
 }
 
+const checkForCorrectFiles = languageFiles => {
+  if (
+    languageFiles.JAVASCRIPT.includes('package-lock.json') &&
+    languageFiles.JAVASCRIPT.includes('yarn.lock')
+  ) {
+    throw new Error(
+      i18n.__('languageAnalysisHasMultipleLockFiles', 'javascript')
+    )
+  }
+
+  if (
+    !languageFiles.JAVASCRIPT.includes('package-lock.json') &&
+    !languageFiles.JAVASCRIPT.includes('yarn.lock')
+  ) {
+    throw new Error(i18n.__('languageAnalysisHasNoLockFile', 'javascript'))
+  }
+
+  if (!languageFiles.JAVASCRIPT.includes('package.json')) {
+    throw new Error(i18n.__('languageAnalysisHasNoPackageJsonFile'))
+  }
+}
 module.exports = {
   jsAnalysis
 }

package/src/scaAnalysis/php/analysis.js

@@ -2,24 +2,24 @@ const fs = require('fs')
 const i18n = require('i18n')
 const _ = require('lodash')
 
-let php = {}
+const readFile = (config, nameOfFile) => {
+  if (config.file) {
+    try {
+      return fs.readFileSync(config.file + '/' + nameOfFile)
+    } catch (error) {
+      console.log('Unable to find file')
+      console.log(error)
+    }
+  }
+}
 
-const readProjectFile = (projectPath, customFile) => {
-  const filePath = filePathForWindows(projectPath + customFile)
+const parseProjectFiles = php => {
   try {
-    php.composerJSON = JSON.parse(fs.readFileSync(filePath, 'utf8')) //wrong here
+    // composer.json
     php.composerJSON.dependencies = php.composerJSON.require
     php.composerJSON.devDependencies = php.composerJSON['require-dev']
-    return php
-  } catch (err) {
-    console.log(err.message.toString())
-  }
-}
 
-const readAndParseLockFile = (projectPath, customFile) => {
-  const filePath = filePathForWindows(projectPath + customFile)
-  try {
-    php.rawLockFileContents = JSON.parse(fs.readFileSync(filePath, 'utf8'))
+    // composer.lock
     php.lockFile = php.rawLockFileContents
     let packages = _.keyBy(php.lockFile.packages, 'name')
     let packagesDev = _.keyBy(php.lockFile['packages-dev'], 'name')
@@ -54,25 +54,6 @@ const readAndParseLockFile = (projectPath, customFile) => {
   }
 }
 
-const getPhpDeps = (config, files) => {
-  try {
-    return (
-      readProjectFile(config.file, files[0].projectFilename),
-      readAndParseLockFile(config.file, files[1].lockFilename)
-    )
-  } catch (err) {
-    console.log(err.message.toString())
-    process.exit(1)
-  }
-}
-
-const filePathForWindows = path => {
-  if (process.platform === 'win32') {
-    path = path.replace(/\//g, '\\')
-  }
-  return path
-}
-
 function addChildDepToLockFileAsOwnObj(php, depObj, key) {
   php.lockFile.dependencies[key] = { version: depObj[key] }
 }
@@ -92,7 +73,6 @@ function formatParentDepToLockFile(php) {
 }
 
 module.exports = {
-  getPhpDeps,
-  readAndParseLockFile,
-  readProjectFile
+  parseProjectFiles,
+  readFile
 }

package/src/scaAnalysis/php/index.js

@@ -1,9 +1,20 @@
-const { getPhpDeps } = require('./analysis')
+const { readFile, parseProjectFiles } = require('./analysis')
 const { createPhpTSMessage } = require('../common/formatMessage')
 
-const phpAnalysis = (config, languageFiles) => {
-  const phpDeps = getPhpDeps(config, languageFiles.PHP)
-  return createPhpTSMessage(phpDeps)
+const phpAnalysis = (config, files) => {
+  let analysis = readFiles(config, files.PHP)
+  const phpDep = parseProjectFiles(analysis)
+  return createPhpTSMessage(phpDep)
+}
+
+const readFiles = (config, files) => {
+  let php = {}
+
+  php.composerJSON = JSON.parse(readFile(config, 'composer.json'))
+
+  php.rawLockFileContents = JSON.parse(readFile(config, 'composer.lock'))
+
+  return php
 }
 
 module.exports = {

package/src/scaAnalysis/python/analysis.js

@@ -1,5 +1,6 @@
 const multiReplace = require('string-multiple-replace')
 const fs = require('fs')
+const i18n = require('i18n')
 
 const readAndParseProjectFile = file => {
   const filePath = filePathForWindows(file + '/Pipfile')
@@ -23,12 +24,52 @@ const readAndParseLockFile = file => {
   return parsedPipLock
 }
 
-const getPythonDeps = config => {
+const readLockFile = file => {
+  const filePath = filePathForWindows(file + '/Pipfile.lock')
+  const lockFile = fs.readFileSync(filePath, 'utf8')
+  let parsedPipLock = JSON.parse(lockFile)
+  return parsedPipLock['default']
+}
+
+const scaPythonParser = pythonDependencies => {
+  let pythonParsedDeps = {}
+  for (let key in pythonDependencies) {
+    pythonParsedDeps[key] = {}
+    pythonParsedDeps[key].version = pythonDependencies[key].version.replace(
+      '==',
+      ''
+    )
+    pythonParsedDeps[key].group = null
+    pythonParsedDeps[key].name = key
+    pythonParsedDeps[key].isProduction = true
+    pythonParsedDeps[key].dependencies = []
+    pythonParsedDeps[key].directDependency = true
+  }
+  return pythonParsedDeps
+}
+
+const checkForCorrectFiles = languageFiles => {
+  if (!languageFiles.includes('Pipfile.lock')) {
+    throw new Error(i18n.__('languageAnalysisHasNoLockFile', 'python'))
+  }
+
+  if (!languageFiles.includes('Pipfile')) {
+    throw new Error(i18n.__('languageAnalysisProjectFileError', 'python'))
+  }
+}
+
+const getPythonDeps = (config, languageFiles) => {
   try {
-    const parseProject = readAndParseProjectFile(config.file)
-    const parsePip = readAndParseLockFile(config.file)
+    if (config.experimental) {
+      let pythonLockFileContents = readLockFile(config.file)
+      return scaPythonParser(pythonLockFileContents)
+    } else {
+      checkForCorrectFiles(languageFiles)
+      const parseProject = readAndParseProjectFile(config.file)
+      const parsePip = readAndParseLockFile(config.file)
 
-    return { pipfileLock: parsePip, pipfilDependanceies: parseProject }
+      return { pipfileLock: parsePip, pipfilDependanceies: parseProject }
+    }
   } catch (err) {
     console.log(err.message.toString())
     process.exit(1)
@@ -44,6 +85,9 @@ const filePathForWindows = path => {
 
 module.exports = {
   getPythonDeps,
+  scaPythonParser,
+  readAndParseLockFile,
   readAndParseProjectFile,
-  readAndParseLockFile
+  checkForCorrectFiles,
+  readLockFile
 }

package/src/scaAnalysis/python/index.js

@@ -1,9 +1,14 @@
 const { createPythonTSMessage } = require('../common/formatMessage')
-const { getPythonDeps } = require('./analysis')
+const { getPythonDeps, secondaryParser } = require('./analysis')
 
 const pythonAnalysis = (config, languageFiles) => {
   const pythonDeps = getPythonDeps(config, languageFiles.PYTHON)
-  return createPythonTSMessage(pythonDeps)
+
+  if (config.experimental) {
+    return pythonDeps
+  } else {
+    return createPythonTSMessage(pythonDeps)
+  }
 }
 
 module.exports = {

package/src/scaAnalysis/ruby/analysis.js

@@ -1,8 +1,8 @@
 const fs = require('fs')
+const i18n = require('i18n')
 
 const readAndParseGemfile = file => {
-  const fileName = filePathForWindows(file + '/Gemfile')
-  const gemFile = fs.readFileSync(fileName, 'utf8')
+  const gemFile = fs.readFileSync(file + '/Gemfile', 'utf8')
   const rubyArray = gemFile.split('\n')
 
   let filteredRubyDep = rubyArray.filter(element => {
@@ -21,8 +21,7 @@ const readAndParseGemfile = file => {
 }
 
 const readAndParseGemLockFile = file => {
-  const fileName = filePathForWindows(file + '/Gemfile.lock')
-  const lockFile = fs.readFileSync(fileName, 'utf8')
+  const lockFile = fs.readFileSync(file + '/Gemfile.lock', 'utf8')
   const dependencyRegEx = /^\s*([A-Za-z0-9.!@#$%\-^&*_+]*)\s*(\((.*?)\))/
 
   const lines = lockFile.split('\n')
@@ -243,27 +242,30 @@ const buildSourceDependencyWithVersion = (
   return dependencies
 }
 
-const getRubyDeps = config => {
+const getRubyDeps = (config, languageFiles) => {
   try {
+    checkForCorrectFiles(languageFiles)
     const parsedGem = readAndParseGemfile(config.file)
     const parsedLock = readAndParseGemLockFile(config.file)
 
     return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock }
   } catch (err) {
-    console.log(err.message)
-    process.exit(1)
+    throw err
   }
 }
 
-const trimWhiteSpace = string => {
-  return string.replace(/\s+/g, '')
-}
+const checkForCorrectFiles = languageFiles => {
+  if (!languageFiles.includes('Gemfile.lock')) {
+    throw new Error(i18n.__('languageAnalysisHasNoLockFile', 'ruby'))
+  }
 
-const filePathForWindows = path => {
-  if (process.platform === 'win32') {
-    path = path.replace(/\//g, '\\')
+  if (!languageFiles.includes('Gemfile')) {
+    throw new Error(i18n.__('languageAnalysisProjectFileError', 'ruby'))
   }
-  return path
+}
+
+const trimWhiteSpace = string => {
+  return string.replace(/\s+/g, '')
 }
 
 module.exports = {
@@ -278,5 +280,6 @@ module.exports = {
   getVersion,
   getPatchLevel,
   formatSourceArr,
-  getSourceArray
+  getSourceArray,
+  checkForCorrectFiles
 }