@contrast/contrast 1.0.9 → 1.0.12

package/src/audit/{languageAnalysisEngine/report → report}/commonReportingFunctions.ts

@@ -1,4 +1,4 @@
-import { getHttpClient, handleResponseErrors } from '../../../utils/commonApi'
+import { getHttpClient, handleResponseErrors } from '../../utils/commonApi'
 import {
   ReportCompositeKey,
   ReportList,
@@ -22,15 +22,17 @@ import {
   ReportOutputModel
 } from './models/reportOutputModel'
 import {
+  CE_URL,
   CRITICAL_COLOUR,
   HIGH_COLOUR,
   LOW_COLOUR,
   MEDIUM_COLOUR,
   NOTE_COLOUR
-} from '../../../constants/constants'
+} from '../../constants/constants'
 import Table from 'cli-table3'
+import { ReportGuidanceModel } from './models/reportGuidanceModel'
 
-export const createSummaryMessage = (
+export const createSummaryMessageTop = (
   numberOfVulnerableLibraries: number,
   numberOfCves: number
 ) => {
@@ -41,6 +43,14 @@ export const createSummaryMessage = (
       )
 }
 
+export const createSummaryMessageBottom = (
+  numberOfVulnerableLibraries: number
+) => {
+  numberOfVulnerableLibraries === 1
+    ? console.log(`Found 1 vulnerable library`)
+    : console.log(`Found ${numberOfVulnerableLibraries} vulnerable libraries`)
+}
+
 export const getReport = async (config: any, reportId: string) => {
   const client = getHttpClient(config)
   return client
@@ -86,7 +96,7 @@ export const printFormattedOutput = (
   numberOfCves: number,
   guidance: any
 ) => {
-  createSummaryMessage(numberOfVulnerableLibraries, numberOfCves)
+  createSummaryMessageTop(numberOfVulnerableLibraries, numberOfCves)
   console.log()
   const report = new ReportList()
 
@@ -160,7 +170,11 @@ export const printFormattedOutput = (
       numOfCVEs
     )
 
-    const advice = gatherRemediationAdvice(guidance, reportModel)
+    const advice = gatherRemediationAdvice(
+      guidance,
+      libraryName,
+      libraryVersion
+    )
 
     const body = buildBody(reportModel.cveArray, advice)
 
@@ -168,7 +182,6 @@ export const printFormattedOutput = (
 
     table.push(
       reportOutputModel.body.issueMessage,
-      reportOutputModel.body.issueMessageCves,
       reportOutputModel.body.adviceMessage
     )
 
@@ -179,7 +192,7 @@ export const printFormattedOutput = (
     console.log(table.toString() + '\n')
   }
 
-  createSummaryMessage(numberOfVulnerableLibraries, numberOfCves)
+  createSummaryMessageBottom(numberOfVulnerableLibraries)
   const {
     criticalMessage,
     highMessage,
@@ -190,6 +203,15 @@ export const printFormattedOutput = (
   console.log(
     `${criticalMessage} | ${highMessage} | ${mediumMessage} | ${lowMessage} | ${noteMessage}`
   )
+
+  if (config.host !== CE_URL) {
+    console.log(
+      '\n' + chalk.bold('View your full dependency tree in Contrast:')
+    )
+    console.log(
+      `${config.host}/Contrast/static/ng/index.html#/${config.organizationId}/applications/${config.applicationId}/libs/dependency-tree`
+    )
+  }
 }
 
 export function buildHeader(
@@ -203,18 +225,22 @@ export function buildHeader(
     numOfCVEs > 1 ? 'vulnerabilities' : 'vulnerability'
   const formattedHeaderNum = buildFormattedHeaderNum(contrastHeaderNum)
 
-  const vulnMessage = chalk
-    .hex(highestSeverity.outputColour)
-    .bold(
-      `${formattedHeaderNum} - [${highestSeverity.severity}] ${libraryName}-${version}`
-    )
+  const headerColour = chalk.hex(highestSeverity.outputColour)
+  const headerNumAndSeverity = headerColour(
+    `${formattedHeaderNum} - [${highestSeverity.severity}]`
+  )
+  const libraryNameAndVersion = headerColour.bold(`${libraryName}-${version}`)
+  const vulnMessage = `${headerNumAndSeverity} ${libraryNameAndVersion}`
 
   const introducesMessage = `introduces ${numOfCVEs} ${vulnerabilityPluralised}`
 
   return new ReportOutputHeaderModel(vulnMessage, introducesMessage)
 }
 
-export function buildBody(cveArray: ReportCVEModel[], advice: any) {
+export function buildBody(
+  cveArray: ReportCVEModel[],
+  advice: ReportGuidanceModel
+) {
   const cveMessages: string[] = []
 
   findCVESeveritiesAndOrderByHighestPriority(cveArray).forEach(
@@ -233,46 +259,40 @@ export function buildBody(cveArray: ReportCVEModel[], advice: any) {
 
   const numAndSeverityType = getNumOfAndSeverityType(cveArray)
 
-  const issueMessage = [chalk.bold('Issue'), ':', `${numAndSeverityType}`]
-
-  const issueMessageCves = ['', '', cveMessages.join(', ')]
+  const issueMessage = [
+    chalk.bold('Issue'),
+    ':',
+    `${numAndSeverityType} ${cveMessages.join(', ')}`
+  ]
 
   //todo different advice based on remediationGuidance being available or now
   // console.log(advice)
 
-  const displayAdvice = advice?.minimum
-    ? `Update to version ${chalk.bold(advice.minimum)}`
-    : `Update to latest version`
+  const minOrMax = advice.maximum ? advice.maximum : advice.minimum
+  const displayAdvice = minOrMax
+    ? `Change to version ${chalk.bold(minOrMax)}`
+    : 'No recommendation is available according to our data. Upgrade to the latest stable is the best advice we can give.'
 
   const adviceMessage = [chalk.bold('Advice'), ':', displayAdvice]
 
-  return new ReportOutputBodyModel(
-    issueMessage,
-    issueMessageCves,
-    adviceMessage
-  )
+  return new ReportOutputBodyModel(issueMessage, adviceMessage)
 }
 
-export function gatherRemediationAdvice(guidance: any, reportModel: any) {
-  const guidanceData = {
-    minimum: undefined,
-    maximum: undefined,
-    latest: undefined
-  }
+export function gatherRemediationAdvice(
+  guidance: any,
+  libraryName: string,
+  libraryVersion: string
+) {
+  const guidanceModel = new ReportGuidanceModel()
 
-  const data =
-    guidance[
-      reportModel.compositeKey.libraryName +
-        '@' +
-        reportModel.compositeKey.libraryVersion
-    ]
+  const data = guidance[libraryName + '@' + libraryVersion]
 
   if (data) {
-    guidanceData.minimum = data.minUpgradeVersion
-    guidanceData.maximum = data.maxUpgradeVersion
+    guidanceModel.minimum = data.minUpgradeVersion
+    guidanceModel.maximum = data.maxUpgradeVersion
   }
 
-  return guidanceData
+  return guidanceModel
 }
 
 export function buildFormattedHeaderNum(contrastHeaderNum: number) {
@@ -285,11 +305,27 @@ export function getNumOfAndSeverityType(cveArray: ReportCVEModel[]) {
     new SeverityCountModel()
   )
 
-  const criticalMessage = critical > 0 ? `${critical} Critical` : ''
-  const highMessage = high > 0 ? `${high} High` : ''
-  const mediumMessage = medium > 0 ? `${medium} Medium` : ''
-  const lowMessage = low > 0 ? `${low} Low` : ''
-  const noteMessage = note > 0 ? `${note} Note` : ''
+  const criticalNumCheck = critical > 0
+
+  const highNumCheck = high > 0
+  const highDivider = highNumCheck ? '|' : ''
+
+  const mediumNumCheck = medium > 0
+  const mediumDivider = mediumNumCheck ? '|' : ''
+
+  const lowNumCheck = low > 0
+  const lowDivider = lowNumCheck ? '|' : ''
+
+  const noteNumCheck = low > 0
+  const noteDivider = noteNumCheck ? '|' : ''
+
+  const criticalMessage = criticalNumCheck
+    ? `${critical} Critical ${highDivider}`
+    : ''
+  const highMessage = highNumCheck ? `${high} High ${mediumDivider}` : ''
+  const mediumMessage = mediumNumCheck ? `${medium} Medium ${lowDivider}` : ''
+  const lowMessage = lowNumCheck ? `${low} Low ${noteDivider}` : ''
+  const noteMessage = noteNumCheck ? `${note} Note` : ''
 
   //removes/trims whitespace to single spaces
   return `${criticalMessage} ${highMessage} ${mediumMessage} ${lowMessage} ${noteMessage}`

package/src/audit/report/models/reportGuidanceModel.ts

@@ -0,0 +1,5 @@
+export class ReportGuidanceModel {
+  minimum?: string
+  maximum?: string
+  latest?: string
+}

package/src/audit/{languageAnalysisEngine/report → report}/models/reportOutputModel.ts

@@ -20,16 +20,10 @@ export class ReportOutputHeaderModel {
 
 export class ReportOutputBodyModel {
   issueMessage: string[]
-  issueMessageCves: string[]
   adviceMessage: string[]
 
-  constructor(
-    issueMessage: string[],
-    issueMessageCves: string[],
-    adviceMessage: string[]
-  ) {
+  constructor(issueMessage: string[], adviceMessage: string[]) {
     this.issueMessage = issueMessage
-    this.issueMessageCves = issueMessageCves
     this.adviceMessage = adviceMessage
   }
 }

package/src/audit/{languageAnalysisEngine/report → report}/models/severityCountModel.ts

@@ -4,6 +4,7 @@ export class SeverityCountModel {
   medium!: number
   low!: number
   note!: number
+  total!: number
 
   //needed as default to stop NaN when new object constructed
   constructor() {
@@ -12,6 +13,7 @@ export class SeverityCountModel {
     this.medium = 0
     this.low = 0
     this.note = 0
+    this.total = 0
   }
 
   get getTotal(): number {

package/src/audit/{languageAnalysisEngine/report → report}/reportingFeature.ts

@@ -8,7 +8,9 @@ import {
 } from './utils/reportUtils'
 import i18n from 'i18n'
 import chalk from 'chalk'
-import * as constants from '../../../constants/constants'
+import * as constants from '../../constants/constants'
+import { SeverityCountModel } from './models/severityCountModel'
+import * as common from '../../common/fail'
 
 export function convertKeysToStandardFormat(config: any, guidance: any) {
   let convertedGuidance = guidance
@@ -72,6 +74,7 @@ export function formatVulnerabilityOutput(
         String(0)
       )
     )
+    return [false, 0, [new SeverityCountModel()]]
   } else {
     let numberOfCves = 0
     vulnerableLibraries.forEach(lib => (numberOfCves += lib.cveArray.length))
@@ -83,12 +86,13 @@ export function formatVulnerabilityOutput(
       numberOfCves,
       guidance
     )
-
-    return [
-      hasSomeVulnerabilitiesReported,
-      numberOfCves,
-      severityCountAllLibraries(vulnerableLibraries)
-    ]
+    let severityCount = new SeverityCountModel()
+    severityCount = severityCountAllLibraries(
+      vulnerableLibraries,
+      severityCount
+    )
+    severityCount.total = severityCount.getTotal
+    return [hasSomeVulnerabilitiesReported, numberOfCves, severityCount]
   }
 }
 
@@ -97,8 +101,7 @@ export async function vulnerabilityReportV2(config: any, reportId: string) {
   const reportResponse = await getReport(config, reportId)
 
   if (reportResponse !== undefined) {
-    const name = config.applicationName
-    formatVulnerabilityOutput(
+    let output = formatVulnerabilityOutput(
       reportResponse.vulnerabilities,
       config.applicationId,
       config,
@@ -106,5 +109,9 @@ export async function vulnerabilityReportV2(config: any, reportId: string) {
         ? reportResponse.remediationGuidance
         : {}
     )
+
+    if (config.fail) {
+      common.processFail(config, output[2])
+    }
   }
 }

package/src/audit/{languageAnalysisEngine/report → report}/utils/reportUtils.ts

@@ -3,7 +3,7 @@ import {
   ReportLibraryModel
 } from '../models/reportLibraryModel'
 import { ReportSeverityModel } from '../models/reportSeverityModel'
-import languageAnalysisEngine from './../../../../constants/constants'
+import languageAnalysisEngine from '../../../constants/constants'
 import {
   CRITICAL_COLOUR,
   CRITICAL_PRIORITY,
@@ -15,7 +15,7 @@ import {
   MEDIUM_PRIORITY,
   NOTE_COLOUR,
   NOTE_PRIORITY
-} from '../../../../constants/constants'
+} from '../../../constants/constants'
 import { orderBy } from 'lodash'
 import { SeverityCountModel } from '../models/severityCountModel'
 import { ReportModelStructure } from '../models/reportListModel'
@@ -75,9 +75,9 @@ export function convertGenericToTypedLibraryVulns(libraries: any) {
 }
 
 export function severityCountAllLibraries(
-  vulnerableLibraries: ReportLibraryModel[]
+  vulnerableLibraries: ReportLibraryModel[],
+  severityCount: SeverityCountModel
 ) {
-  const severityCount = new SeverityCountModel()
   vulnerableLibraries.forEach(lib =>
     severityCountAllCVEs(lib.cveArray, severityCount)
   )

package/src/commands/audit/auditConfig.ts

@@ -1,9 +1,16 @@
 import paramHandler from '../../utils/paramsUtil/paramHandler'
 import constants from '../../constants'
-import cliOptions from '../../utils/parsedCLIOptions'
+import { getCommandLineArgsCustom } from '../../utils/parsedCLIOptions'
+import { ContrastConf } from '../../utils/getConfig'
 
-export const getAuditConfig = (argv: string[]): { [key: string]: string } => {
-  const auditParameters = cliOptions.getCommandLineArgsCustom(
+export const getAuditConfig = async (
+  contrastConf: ContrastConf,
+  command: string,
+  argv: string[]
+): Promise<{ [key: string]: string }> => {
+  const auditParameters = await getCommandLineArgsCustom(
+    contrastConf,
+    command,
     argv,
     constants.commandLineDefinitions.auditOptionDefinitions
   )

package/src/commands/audit/help.ts

@@ -1,6 +1,7 @@
 import commandLineUsage from 'command-line-usage'
 import i18n from 'i18n'
 import constants from '../../constants'
+import { commonHelpLinks } from '../../common/commonHelp'
 
 const auditUsageGuide = commandLineUsage([
   {
@@ -48,7 +49,8 @@ const auditUsageGuide = commandLineUsage([
       'app-groups',
       'metadata'
     ]
-  }
+  },
+  commonHelpLinks()
 ])
 
 export { auditUsageGuide }

package/src/commands/audit/processAudit.ts

@@ -1,16 +1,30 @@
 import { getAuditConfig } from './auditConfig'
 import { auditUsageGuide } from './help'
 import { processSca } from '../scan/sca/scaAnalysis'
+import { sendTelemetryConfigAsObject } from '../../telemetry/telemetry'
+import { ContrastConf } from '../../utils/getConfig'
 
 export type parameterInput = string[]
 
-export const processAudit = async (argv: parameterInput) => {
+export const processAudit = async (
+  contrastConf: ContrastConf,
+  argv: parameterInput
+) => {
   if (argv.indexOf('--help') != -1) {
     printHelpMessage()
     process.exit(0)
   }
-  const config = getAuditConfig(argv)
+
+  const config = await getAuditConfig(contrastConf, 'audit', argv)
   await processSca(config)
+  await sendTelemetryConfigAsObject(
+    config,
+    'audit',
+    argv,
+    'SUCCESS',
+    // @ts-ignore
+    config.language
+  )
 }
 
 const printHelpMessage = () => {

package/src/commands/auth/auth.js

@@ -16,7 +16,9 @@ const constants = require('../../constants')
 const commandLineUsage = require('command-line-usage')
 
 const processAuth = async (argv, config) => {
-  let authParams = parsedCLIOptions.getCommandLineArgsCustom(
+  let authParams = await parsedCLIOptions.getCommandLineArgsCustom(
+    config,
+    'auth',
     argv,
     constants.commandLineDefinitions.authOptionDefinitions
   )

package/src/commands/config/config.js

@@ -3,9 +3,11 @@ const constants = require('../../constants')
 const commandLineUsage = require('command-line-usage')
 const i18n = require('i18n')
 
-const processConfig = (argv, config) => {
+const processConfig = async (argv, config) => {
   try {
-    let configParams = parsedCLIOptions.getCommandLineArgsCustom(
+    let configParams = await parsedCLIOptions.getCommandLineArgsCustom(
+      config,
+      'config',
       argv,
       constants.commandLineDefinitions.configOptionDefinitions
     )

package/src/commands/scan/processScan.js

@@ -4,23 +4,37 @@ const { saveScanFile } = require('../../utils/saveFile')
 const { ScanResultsModel } = require('../../scan/models/scanResultsModel')
 const { formatScanOutput } = require('../../scan/formatScanOutput')
 const { processSca } = require('./sca/scaAnalysis')
+const common = require('../../common/fail')
+const { sendTelemetryConfigAsObject } = require('../../telemetry/telemetry')
 
-const processScan = async argvMain => {
-  let config = scanConfig.getScanConfig(argvMain)
+const processScan = async (contrastConf, argv) => {
+  let config = await scanConfig.getScanConfig(contrastConf, 'scan', argv)
+  let output = undefined
   //try SCA analysis first
   if (config.experimental) {
-    await processSca(config)
+    await processSca(config, argv)
   }
 
   let scanResults = new ScanResultsModel(await startScan(config))
+  await sendTelemetryConfigAsObject(
+    config,
+    'scan',
+    argv,
+    'SUCCESS',
+    scanResults.scanDetail.language
+  )
 
   if (scanResults.scanResultsInstances !== undefined) {
-    formatScanOutput(scanResults)
+    output = formatScanOutput(scanResults)
   }
 
   if (config.save !== undefined) {
     await saveScanFile(config, scanResults)
   }
+
+  if (config.fail) {
+    common.processFail(config, output)
+  }
 }
 
 module.exports = {

package/src/commands/scan/sca/scaAnalysis.js

@@ -21,20 +21,35 @@ const {
 const i18n = require('i18n')
 const {
   vulnerabilityReportV2
-} = require('../../../audit/languageAnalysisEngine/report/reportingFeature')
+} = require('../../../audit/report/reportingFeature')
 const auditSave = require('../../../audit/save')
 const { dotNetAnalysis } = require('../../../scaAnalysis/dotnet')
+const { auditUsageGuide } = require('../../audit/help')
+const rootFile = require('../../../audit/languageAnalysisEngine/getProjectRootFilenames')
+const path = require('path')
 const processSca = async config => {
   const startTime = performance.now()
   let filesFound
-  if (config.file) {
-    config.file = config.file.concat('/')
-    filesFound = await autoDetection.autoDetectAuditFilesAndLanguages(
-      config.file
+
+  if (config.help) {
+    console.log(auditUsageGuide)
+    process.exit(0)
+  }
+
+  const projectStats = await rootFile.getProjectStats(config.file)
+  let pathWithFile = projectStats.isFile()
+
+  config.fileName = config.file
+  config.file = pathWithFile
+    ? rootFile.getDirectoryFromPathGiven(config.file).concat('/')
+    : config.file
+
+  filesFound = await autoDetection.autoDetectAuditFilesAndLanguages(config.file)
+
+  if (filesFound.length > 1 && pathWithFile) {
+    filesFound = filesFound.filter(i =>
+      Object.values(i)[0].includes(path.basename(config.fileName))
     )
-  } else {
-    filesFound = await autoDetection.autoDetectAuditFilesAndLanguages(undefined)
-    config.file = process.cwd().concat('/')
   }
 
   // files found looks like [ { javascript: [ Array ] } ]
@@ -62,7 +77,7 @@ const processSca = async config => {
         messageToSend = rubyAnalysis(config, filesFound[0])
         config.language = RUBY
         break
-      case 'PHP':
+      case PHP:
         messageToSend = phpAnalysis.phpAnalysis(config, filesFound[0])
         config.language = PHP
         break
@@ -118,7 +133,9 @@ const processSca = async config => {
       throw new Error()
     } else {
       throw new Error(
-        'multiple language files detected, please use --file to specify a directory or the file where dependencies are declared'
+        `multiple language files detected \n` +
+          JSON.stringify(filesFound) +
+          `\nplease use --file to audit one language only. Example: contrast audit --file package-lock.json`
       )
     }
   }

package/src/common/HTTPClient.js

@@ -212,6 +212,7 @@ HTTPClient.prototype.sendSnapshot = function sendSnapshot(requestBody, config) {
   let url = createSnapshotURL(config)
   options.url = url
   options.body = requestBody
+
   return requestUtils.sendRequest({ method: 'post', options })
 }
 
@@ -346,6 +347,16 @@ HTTPClient.prototype.getLatestVersion = function getLatestVersion() {
   return requestUtils.sendRequest({ method: 'get', options })
 }
 
+HTTPClient.prototype.postTelemetry = function postTelemetry(
+  config,
+  requestBody
+) {
+  const options = _.cloneDeep(this.requestOptions)
+  options.url = createTelemetryEventUrl(config)
+  options.body = requestBody
+  return requestUtils.sendRequest({ method: 'post', options })
+}
+
 // analytics
 
 HTTPClient.prototype.postAnalyticsFunction = function (config, provider, body) {
@@ -439,6 +450,10 @@ function createSbomUrl(config, type) {
   return `${config.host}/Contrast/api/ng/${config.organizationId}/applications/${config.applicationId}/libraries/sbom/${type}`
 }
 
+function createTelemetryEventUrl(config) {
+  return `${config.host}/Contrast/api/sast/organizations/${config.organizationId}/cli`
+}
+
 module.exports = HTTPClient
 module.exports.pollForAuthUrl = pollForAuthUrl
 module.exports.getServerlessHost = getServerlessHost

package/src/common/commonHelp.ts

@@ -0,0 +1,13 @@
+import i18n from 'i18n'
+
+export function commonHelpLinks() {
+  return {
+    header: i18n.__('commonHelpHeader'),
+    content: [
+      i18n.__('commonHelpCheckOutHeader') + i18n.__('commonHelpCheckOutText'),
+      i18n.__('commonHelpLearnMoreHeader') + i18n.__('commonHelpLearnMoreText'),
+      i18n.__('commonHelpJoinDiscussionHeader') +
+        i18n.__('commonHelpJoinDiscussionText')
+    ]
+  }
+}

package/src/common/errorHandling.ts

@@ -39,9 +39,8 @@ const reportFailureError = () => {
 }
 
 const genericError = (missingCliOption: string) => {
-  // prettier-ignore
-  console.log(`*************************** ${i18n.__('yamlMissingParametersHeader')} ***************************\n${missingCliOption}`)
-  console.error(i18n.__('yamlMissingParametersMessage'))
+  console.log(missingCliOption)
+  console.error(i18n.__('genericErrorMessage'))
   process.exit(1)
 }