@contrast/contrast 1.0.9 → 1.0.12

package/src/common/fail.js

@@ -0,0 +1,75 @@
+const i18n = require('i18n')
+
+const processFail = (config, reportResults) => {
+  if (config.severity !== undefined) {
+    if (
+      reportResults[config.severity] !== undefined &&
+      isSeverityViolation(config.severity, reportResults)
+    ) {
+      failPipeline('failSeverityOptionErrorMessage')
+    }
+  }
+
+  if (config.severity === undefined && reportResults.total > 0) {
+    failPipeline('failThresholdOptionErrorMessage')
+  }
+}
+
+const isSeverityViolation = (severity, reportResults) => {
+  let count = 0
+  switch (severity) {
+    case 'critical':
+      count += reportResults.critical
+      break
+    case 'high':
+      count += reportResults.high + reportResults.critical
+      break
+    case 'medium':
+      count += reportResults.medium + reportResults.low + reportResults.critical
+      break
+    case 'low':
+      count +=
+        reportResults.high + reportResults.critical + reportResults.medium
+      break
+    case 'note':
+      if (reportResults.note == reportResults.total) {
+        count = 0
+      } else {
+        count = reportResults.total
+      }
+      break
+    default:
+      count = 0
+  }
+  return count > 0
+}
+
+const failPipeline = (message = '') => {
+  console.log(
+    '\n ******************************** ' +
+      i18n.__('snapshotFailureHeader') +
+      ' *********************************\n' +
+      i18n.__(message)
+  )
+  process.exit(1)
+}
+
+const parseSeverity = severity => {
+  const severities = ['NOTE', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL']
+  if (severities.includes(severity.toUpperCase())) {
+    return severity.toLowerCase()
+  } else {
+    console.log(
+      severity +
+        ' Not recognised as a severity type please use LOW, MEDIUM, HIGH, CRITICAL, NOTE'
+    )
+    return undefined
+  }
+}
+
+module.exports = {
+  failPipeline,
+  processFail,
+  isSeverityViolation,
+  parseSeverity
+}

package/src/common/versionChecker.ts

@@ -18,11 +18,11 @@ const getLatestVersion = async (config: any) => {
   }
 }
 
-// @ts-ignore
 export async function findLatestCLIVersion(config: ContrastConf) {
-  const messageHidden = config.get('updateMessageHidden') as boolean
-
-  if (!messageHidden) {
+  const isCI = process.env.CONTRAST_CODESEC_CI
+    ? JSON.parse(process.env.CONTRAST_CODESEC_CI)
+    : false
+  if (!isCI) {
     let latestCLIVersion: string = await getLatestVersion(config)
     //strip key
     latestCLIVersion = latestCLIVersion.substring(8)

package/src/constants/constants.js

@@ -14,7 +14,7 @@ const HIGH = 'HIGH'
 const CRITICAL = 'CRITICAL'
 // App
 const APP_NAME = 'contrast'
-const APP_VERSION = '1.0.9'
+const APP_VERSION = '1.0.12'
 const TIMEOUT = 120000
 const HIGH_COLOUR = '#ff9900'
 const CRITICAL_COLOUR = '#e35858'
@@ -32,7 +32,7 @@ const AUTH_CALLBACK_URL = 'https://cli-auth-api.contrastsecurity.com'
 const SARIF_FILE = 'SARIF'
 const SBOM_CYCLONE_DX_FILE = 'cyclonedx'
 const SBOM_SPDX_FILE = 'spdx'
-const CE_URL = 'https://ce.contrastsecurity.com/'
+const CE_URL = 'https://ce.contrastsecurity.com'
 
 module.exports = {
   supportedLanguages: { NODE, DOTNET, JAVA, RUBY, PYTHON, GO, PHP, JAVASCRIPT },

package/src/constants/locales.js

@@ -20,8 +20,8 @@ const en_locales = () => {
     libraryAnalysisError:
       'Please ensure the language parameter is set in accordance to the language specified on the project path.\nContrast CLI must be run in the same directory as the project manifest file OR the project_path parameter must be used to identify the directory containing the project manifest file.\n\nFor further information please read our usage guide, which can be accessed with the following command:\n\ncontrast-cli --help',
     yamlMissingParametersHeader: 'Missing Parameters',
-    yamlMissingParametersMessage:
-      'The following parameters are required: \n \norganization-id \napi-key \nauthorization \nhost \nlanguage \n \nThey must be specified as a command line argument. \nFor further information please read our usage guide, which can be accessed with the following command:\ncontrast audit --help',
+    genericErrorMessage:
+      'An error has occur please check your command again. For more information use the --help commands.',
     unauthenticatedErrorHeader: '401 error - Unauthenticated',
     unauthenticatedErrorMessage:
       'Please check the following keys are correct:\n--organization-id, --api-key or --authorization',
@@ -67,7 +67,7 @@ const en_locales = () => {
       'Failed to get information about the file or directory @ %s because: ',
     languageAnalysisFailure: ' analysis failed because: ',
     languageAnalysisNoLanguage:
-      'We cannot detect a project, use --f <path> to specify a file or folder to analyze.',
+      'We cannot detect a project, use -f <path> to specify a file or folder to analyze.',
     languageAnalysisNoLanguageHelpLine: `${chalk.bold(
       'contrast audit --help'
     )} for more information.`,
@@ -121,9 +121,11 @@ const en_locales = () => {
       'The name of the application cataloged by Contrast UI',
     constantsCatalogueApplication:
       'Provide this if you want to catalogue an application',
+    failOptionErrorMessage:
+      ' FAIL - CVEs have been detected that match at least the cve_severity option specified.',
     constantsLanguage:
       'Valid values are JAVA, DOTNET, NODE, PYTHON and RUBY. If there are multiple project configuration files in the project_path, language is also required.  Also, provide this when cataloguing an application',
-    constantsFilePath: `Path of the file you want to perform an SCA audit on. If no folder is specified, Contrast searches for dependency files in the working directory.`,
+    constantsFilePath: `Specify a directory or the file where dependencies are declared. (By default, CodeSec will search for project files in the current directory.)`,
     constantsSilent: 'Silences JSON output.',
     constantsAppGroups:
       'Assign your application to one or more pre-existing groups when using the catalogue command. Group lists should be comma separated.',
@@ -142,16 +144,22 @@ const en_locales = () => {
     constantsReport: 'Display vulnerability information for this application',
     constantsFail:
       'Set the process to fail if this option is set in combination with --cve_severity.',
-    failOptionErrorMessage:
-      ' FAIL - CVEs have been detected that match at least the cve_severity or cve_threshold option specified.',
+    failThresholdOptionErrorMessage: 'More than 0 vulnerabilities found',
+    failSeverityOptionErrorMessage:
+      ' FAIL - Results detected vulnerabilities over accepted severity level',
     constantsSeverity:
       'Allows the user to report libraries with vulnerabilities above a chosen severity level. For example, cve_severity medium only reports libraries with vulnerabilities at medium or higher severity. Values for level are high, medium or low.',
     constantsCount: 'The number of CVEs that must be exceeded to fail a build',
     constantsHeader: 'CodeSec by Contrast Security',
+    configHeader2: 'Config options',
+    clearHeader: '-c, --clear',
+    clearContent: 'Removes stored credentials',
     constantsPrerequisitesContentScanLanguages:
       'Java, Javascript and .NET supported',
     constantsContrastContent:
-      "Use the 'contrast' command for fast and accurate security analysis of your applications and APIs (Java, JavaScript and .NET ) as well as serverless functions (AWS lambda, Java and Python).",
+      'Use the ‘contrast’ command for fast and accurate security analysis of your applications, APIs, serverless functions, and libraries.',
+    constantsContrastCategories:
+      '\n Code: Java, .NET, .NET Core, JavaScript\n Serverless: AWS Lambda - Java, Python\n Libraries: Java, .NET, Node, Ruby, Python, Go, PHP\n',
     constantsUsageGuideContentRecommendation:
       'Our recommendation is that this is invoked as part of a CI pipeline so that running the cli is automated as part of your build process.',
     constantsPrerequisitesHeader: 'Pre-requisites',
@@ -282,12 +290,17 @@ const en_locales = () => {
       'We only accept the following file types: \nJava - .jar, .war \nJavaScript - .js or .zip files',
     helpAuthSummary:
       'Authenticate Contrast using your Github or Google account',
-    helpScanSummary: 'Perform static analysis on binaries / code artifacts',
-    helpLambdaSummary: 'Perform scan on AWS Lambda functions',
+    helpAuditSummary:
+      'Searches for a suitable file in the working directory to perform a security audit of dependencies and returns the results. [Contrast audit --help (for options).]',
+    helpScanSummary:
+      'Searches for a .jar, .war, .js, or .zip file in the working directory, uploads files for analysis, and returns the results. [For further help/options, enter scan --help]',
+    helpLambdaSummary:
+      'Performs a static security scan on an AWS lambda function. lambda --help (for options)',
     helpVersionSummary: 'Displays version of Contrast CLI',
     helpConfigSummary: 'Displays stored credentials',
     helpSummary: 'Displays usage guide',
     authName: 'auth',
+    auditName: 'audit',
     scanName: 'scan',
     lambdaName: 'lambda',
     versionName: 'version',
@@ -305,8 +318,7 @@ const en_locales = () => {
     scanOptionsVerboseSummary: ' Returns extended information to the terminal.',
     authSuccessMessage: 'Authentication successful',
     runAuthSuccessMessage:
-      "Now you can use Contrast CLI \nRun 'contrast scan' on your file \n" +
-      "or 'contrast help' to learn more about the capabilities.",
+      "Now you can use CodeSec by Contrast \nRun: \n'contrast scan' on your file \n'contrast audit' on a file or directory,\n'contrast lambda' on an AWS function.\nor 'contrast help' to learn more about the capabilities.",
     authWaitingMessage: 'Waiting for auth...',
     authTimedOutMessage: 'Auth Timed out, try again',
     zipErrorScan:
@@ -334,7 +346,7 @@ const en_locales = () => {
       'Supported runtimes: Java & Python',
     lambdaPrerequisitesContentLambdaDescriptionTitle: 'AWS Requirements\n',
     lambdaPrerequisitesContentLambdaDescription:
-      'Make sure you have the AWS credentials configured on your local environment. \nYou need the following AWS permissions configured on your IAM user:\n   - Lambda: GetFunction, GetLayerVersionֿ\n   - IAM: GetRolePolicy, GetPolicy, GetPolicyVersion, ListRolePolicies, ListAttachedRolePolicies',
+      'Make sure you have the AWS credentials configured on your local environment. \nYou need the following AWS permissions configured on your IAM user:\n   - Lambda: GetFunction, GetLayerVersion, ListFunctions\n   - IAM: GetRolePolicy, GetPolicy, GetPolicyVersion, ListRolePolicies, ListAttachedRolePolicies',
     scanFileNameOption: '-f, --file',
     lambdaFunctionNameOption: '-f, --function-name',
     lambdaListFunctionsOption: '-l, --list-functions',
@@ -405,7 +417,8 @@ const en_locales = () => {
     auditOptionsSaveDescription:
       'Generate and save an SBOM (Software Bill of Materials)\n',
     auditOptionsSaveOptionsDescription:
-      'Valid options are: spdx, cyclonedx (cycloneDX is the default format)',
+      'Valid options are: --save spdx and --save cyclonedx (CycloneDX is the default format.)',
+    exceededFreeTier: `It looks like you are really loving CodeSec! \nYou have reached the monthly scan limit on the FREE tier. \nPlease contact sales@contrastsecurity.com to upgrade.`,
     scanNotCompleted:
       'Scan not completed. Check for framework and language support here: %s',
     auditNotCompleted: 'audit not completed.  Please try again',
@@ -428,6 +441,15 @@ const en_locales = () => {
     auditReportFailureMessage: 'Unable to generate library report',
     auditSCAAnalysisBegins: 'Contrast SCA audit started',
     auditSCAAnalysisComplete: 'Contrast audit complete',
+    commonHelpHeader: 'Need More Help?',
+    commonHelpCheckOutHeader: chalk.hex('#9DC184')('Check out:'),
+    commonHelpCheckOutText: ' https://support.contrastsecurity.com',
+    commonHelpLearnMoreHeader: chalk.hex('#9DC184')('Learn more at:'),
+    commonHelpLearnMoreText: ' https://developer.contrastsecurity.com',
+    commonHelpJoinDiscussionHeader: chalk.hex('#9DC184')(
+      'Join the discussion:'
+    ),
+    commonHelpJoinDiscussionText: ' https://dev.to/codesec',
     ...lambda
   }
 }

package/src/constants.js

@@ -1,6 +1,8 @@
 const commandLineUsage = require('command-line-usage')
 const i18n = require('i18n')
 const { en_locales } = require('./constants/locales.js')
+const { parseSeverity } = require('./common/fail')
+const { commonHelpLinks } = require('./common/commonHelp')
 
 i18n.configure({
   staticCatalog: {
@@ -106,6 +108,24 @@ const scanOptionDefinitions = [
       '}: ' +
       i18n.__('constantsProxyServer')
   },
+  {
+    name: 'fail',
+    type: Boolean,
+    description:
+      '{bold ' +
+      i18n.__('constantsOptional') +
+      '}: ' +
+      i18n.__('failOptionErrorMessage')
+  },
+  {
+    name: 'severity',
+    type: severity => parseSeverity(severity),
+    description:
+      '{bold ' +
+      i18n.__('constantsOptional') +
+      '}: ' +
+      i18n.__('constantsSeverity')
+  },
   {
     name: 'ff',
     type: Boolean,
@@ -213,13 +233,31 @@ const auditOptionDefinitions = [
   {
     name: 'file',
     alias: 'f',
-    defaultValue: process.cwd(),
+    defaultValue: process.cwd().concat('/'),
     description:
       '{bold ' +
       i18n.__('constantsOptional') +
       '}: ' +
       i18n.__('constantsFilePath')
   },
+  {
+    name: 'fail',
+    type: Boolean,
+    description:
+      '{bold ' +
+      i18n.__('constantsOptional') +
+      '}: ' +
+      i18n.__('failOptionErrorMessage')
+  },
+  {
+    name: 'severity',
+    type: severity => parseSeverity(severity),
+    description:
+      '{bold ' +
+      i18n.__('constantsOptional') +
+      '}: ' +
+      i18n.__('constantsSeverity')
+  },
   {
     name: 'app-groups',
     description:
@@ -257,6 +295,7 @@ const auditOptionDefinitions = [
   {
     name: 'ignore-dev',
     type: Boolean,
+    alias: 'i',
     description:
       '{bold ' +
       i18n.__('constantsOptional') +
@@ -293,7 +332,6 @@ const auditOptionDefinitions = [
   },
   {
     name: 'host',
-    alias: 'h',
     description:
       '{bold ' +
       i18n.__('constantsRequired') +
@@ -341,13 +379,21 @@ const auditOptionDefinitions = [
       i18n.__('constantsOptional') +
       '}: ' +
       i18n.__('scanOptionsTimeoutSummary')
+  },
+  {
+    name: 'help',
+    alias: 'h',
+    type: Boolean
   }
 ]
 
 const mainUsageGuide = commandLineUsage([
   {
     header: i18n.__('constantsHeader'),
-    content: [i18n.__('constantsContrastContent')]
+    content: [
+      i18n.__('constantsContrastContent'),
+      i18n.__('constantsContrastCategories')
+    ]
   },
   {
     header: i18n.__('constantsUsage'),
@@ -359,15 +405,19 @@ const mainUsageGuide = commandLineUsage([
       { name: i18n.__('authName'), summary: i18n.__('helpAuthSummary') },
       { name: i18n.__('scanName'), summary: i18n.__('helpScanSummary') },
       { name: i18n.__('lambdaName'), summary: i18n.__('helpLambdaSummary') },
+      { name: i18n.__('auditName'), summary: i18n.__('helpAuditSummary') },
       { name: i18n.__('versionName'), summary: i18n.__('helpVersionSummary') },
       { name: i18n.__('configName'), summary: i18n.__('helpConfigSummary') },
       { name: i18n.__('helpName'), summary: i18n.__('helpSummary') }
     ]
   },
   {
-    content:
-      '{underline https://developer.contrastsecurity.com/} \n For technical support head to {underline https://support.contrastsecurity.com}'
-  }
+    header: i18n.__('configHeader2'),
+    content: [
+      { name: i18n.__('clearHeader'), summary: i18n.__('clearContent') }
+    ]
+  },
+  commonHelpLinks()
 ])
 
 const mainDefinition = [{ name: 'command', defaultOption: true }]

package/src/index.ts

@@ -14,6 +14,7 @@ import {
   isCorrectNodeVersion
 } from './common/versionChecker'
 import { findCommandOnError } from './common/errorHandling'
+import { sendTelemetryConfigAsConfObj } from './telemetry/telemetry'
 
 const {
   commandLineDefinitions: { mainUsageGuide, mainDefinition }
@@ -75,11 +76,11 @@ const start = async () => {
       }
 
       if (command === 'scan') {
-        return await processScan(argvMain)
+        return await processScan(config, argvMain)
       }
 
       if (command === 'audit') {
-        return await processAudit(argvMain)
+        return await processAudit(config, argvMain)
       }
 
       if (
@@ -98,10 +99,24 @@ const start = async () => {
           : console.log(
               `Unknown Command: ${command} \nUse --help for the full list`
             )
+        await sendTelemetryConfigAsConfObj(
+          config,
+          command,
+          argvMain,
+          'FAILURE',
+          'undefined'
+        )
       } else {
         console.log(
           `Unknown Command: ${command} \nUse --help for the full list`
         )
+        await sendTelemetryConfigAsConfObj(
+          config,
+          command,
+          argvMain,
+          'FAILURE',
+          'undefined'
+        )
       }
       process.exit(9)
     } else {

package/src/lambda/help.ts

@@ -1,5 +1,6 @@
 import commandLineUsage from 'command-line-usage'
 import i18n from 'i18n'
+import { commonHelpLinks } from '../common/commonHelp'
 
 const lambdaUsageGuide = commandLineUsage([
   {
@@ -80,9 +81,7 @@ const lambdaUsageGuide = commandLineUsage([
       { name: i18n.__('lambdaHelpOption'), summary: i18n.__('helpSummary') }
     ]
   },
-  {
-    content: '{underline https://www.contrastsecurity.com/developer/codesec}'
-  }
+  commonHelpLinks()
 ])
 
 export { lambdaUsageGuide }

package/src/scaAnalysis/common/scaParserForGoAndJava.js

@@ -0,0 +1,41 @@
+const parseDependenciesForSCAServices = dependencyTreeObject => {
+  let parsedDependencyTree = {}
+  let subDeps
+
+  for (let tree in dependencyTreeObject) {
+    let unParsedDependencyTree = dependencyTreeObject[tree]
+    for (let dependency in unParsedDependencyTree) {
+      subDeps = parseSubDependencies(unParsedDependencyTree[dependency].edges)
+
+      let parsedDependency = {
+        name: unParsedDependencyTree[dependency].artifactID,
+        group: unParsedDependencyTree[dependency].group,
+        version: unParsedDependencyTree[dependency].version,
+        directDependency: unParsedDependencyTree[dependency].type === 'direct',
+        isProduction: true,
+        dependencies: subDeps
+      }
+      parsedDependencyTree[dependency] = parsedDependency
+    }
+  }
+  return parsedDependencyTree
+}
+
+const parseSubDependencies = dependencies => {
+  // converting:
+  // dependencies: {
+  //   'gopkg.in/check.v1@v0.0.0-2': 'gopkg.in/check.v1@v0.0.0-2'
+  // }
+  // to:
+  // dependencies: [ 'gopkg.in/check.v1@v0.0.0-2' ]
+  let subDeps = []
+  for (let x in dependencies) {
+    subDeps.push(dependencies[x])
+  }
+  return subDeps
+}
+
+module.exports = {
+  parseDependenciesForSCAServices,
+  parseSubDependencies
+}

package/src/scaAnalysis/common/treeUpload.js

@@ -2,11 +2,14 @@ const commonApi = require('../../utils/commonApi')
 const { APP_VERSION } = require('../../constants/constants')
 
 const commonSendSnapShot = async (analysis, config) => {
-  const requestBody = {
-    appID: config.applicationId,
-    cliVersion: APP_VERSION,
-    snapshot: analysis
-  }
+  let requestBody = {}
+  config.experimental === true
+    ? (requestBody = sendToSCAServices(config, analysis))
+    : (requestBody = {
+        appID: config.applicationId,
+        cliVersion: APP_VERSION,
+        snapshot: analysis
+      })
 
   const client = commonApi.getHttpClient(config)
   return client
@@ -23,6 +26,19 @@ const commonSendSnapShot = async (analysis, config) => {
     })
 }
 
+const sendToSCAServices = (config, analysis) => {
+  return {
+    applicationId: config.applicationId,
+    dependencyTree: analysis,
+    organizationId: config.organizationId,
+    language: config.language,
+    tool: {
+      name: 'Contrast Codesec',
+      version: APP_VERSION
+    }
+  }
+}
+
 module.exports = {
   commonSendSnapShot
 }

package/src/scaAnalysis/dotnet/analysis.js

@@ -40,9 +40,26 @@ const readAndParseLockFile = lockFilePath => {
   return lockFile
 }
 
+const checkForCorrectFiles = languageFiles => {
+  if (!languageFiles.includes('packages.lock.json')) {
+    throw new Error(i18n.__('languageAnalysisHasNoLockFile', '.NET'))
+  }
+
+  if (!languageFiles.some(i => i.includes('.csproj'))) {
+    throw new Error(i18n.__('languageAnalysisProjectFileError', '.NET'))
+  }
+}
+
 const getDotNetDeps = (filePath, languageFiles) => {
-  const projectFile = readAndParseProjectFile(filePath + `/${languageFiles[0]}`)
-  const lockFile = readAndParseLockFile(filePath + `/${languageFiles[1]}`)
+  checkForCorrectFiles(languageFiles)
+  const projectFileName = languageFiles.find(fileName =>
+    fileName.includes('.csproj')
+  )
+  const lockFileName = languageFiles.find(fileName =>
+    fileName.includes('.json')
+  )
+  const projectFile = readAndParseProjectFile(filePath + `/${projectFileName}`)
+  const lockFile = readAndParseLockFile(filePath + `/${lockFileName}`)
 
   return { projectFile, lockFile }
 }
@@ -50,5 +67,6 @@ const getDotNetDeps = (filePath, languageFiles) => {
 module.exports = {
   getDotNetDeps,
   readAndParseProjectFile,
-  readAndParseLockFile
+  readAndParseLockFile,
+  checkForCorrectFiles
 }

package/src/scaAnalysis/go/goAnalysis.js

@@ -1,14 +1,21 @@
 const { createGoTSMessage } = require('../common/formatMessage')
+const {
+  parseDependenciesForSCAServices
+} = require('../common/scaParserForGoAndJava')
 const goReadDepFile = require('./goReadDepFile')
 const goParseDeps = require('./goParseDeps')
 
-const goAnalysis = (config, languageFiles) => {
+const goAnalysis = config => {
   try {
     const rawGoDependencies = goReadDepFile.getGoDependencies(config)
     const parsedGoDependencies =
       goParseDeps.parseGoDependencies(rawGoDependencies)
 
-    return createGoTSMessage(parsedGoDependencies)
+    if (config.experimental) {
+      return parseDependenciesForSCAServices(parsedGoDependencies)
+    } else {
+      return createGoTSMessage(parsedGoDependencies)
+    }
   } catch (e) {
     console.log(e.message.toString())
   }

package/src/scaAnalysis/java/analysis.js

@@ -6,9 +6,13 @@ const fs = require('fs')
 const MAVEN = 'maven'
 const GRADLE = 'gradle'
 
-const determineProjectTypeAndCwd = (files, file) => {
+const determineProjectTypeAndCwd = (files, config) => {
   const projectData = {}
 
+  if (files.length > 1) {
+    files = files.filter(i => config.fileName.includes(i))
+  }
+
   if (files[0].includes('pom.xml')) {
     projectData.projectType = MAVEN
   } else if (files[0].includes('build.gradle')) {
@@ -16,9 +20,9 @@ const determineProjectTypeAndCwd = (files, file) => {
   }
 
   //clean up the path to be a folder not a file
-  projectData.cwd = file
-    ? file.replace('pom.xml', '').replace('build.gradle', '')
-    : file
+  projectData.cwd = config.file
+    ? config.file.replace('pom.xml', '').replace('build.gradle', '')
+    : config.file
 
   return projectData
 }
@@ -124,7 +128,7 @@ const getJavaBuildDeps = (config, files) => {
   }
 
   try {
-    const projectData = determineProjectTypeAndCwd(files, config.file)
+    const projectData = determineProjectTypeAndCwd(files, config)
     if (projectData.projectType === MAVEN) {
       output.mvnDependancyTreeOutput = buildMaven(config, projectData, timeout)
     } else if (projectData.projectType === GRADLE) {
@@ -138,5 +142,6 @@ const getJavaBuildDeps = (config, files) => {
 }
 
 module.exports = {
-  getJavaBuildDeps
+  getJavaBuildDeps,
+  determineProjectTypeAndCwd
 }

package/src/scaAnalysis/java/index.js

@@ -1,6 +1,9 @@
 const analysis = require('./analysis')
 const { parseBuildDeps } = require('./javaBuildDepsParser')
 const { createJavaTSMessage } = require('../common/formatMessage')
+const {
+  parseDependenciesForSCAServices
+} = require('../common/scaParserForGoAndJava')
 
 const javaAnalysis = (config, languageFiles) => {
   languageFiles.JAVA.forEach(file => {
@@ -8,7 +11,12 @@ const javaAnalysis = (config, languageFiles) => {
   })
 
   const javaDeps = buildJavaTree(config, languageFiles.JAVA)
-  return createJavaTSMessage(javaDeps)
+
+  if (config.experimental) {
+    return parseDependenciesForSCAServices(javaDeps)
+  } else {
+    return createJavaTSMessage(javaDeps)
+  }
 }
 
 const buildJavaTree = (config, files) => {