@contrast/contrast 2.0.0 → 2.0.2-beta.0

package/src/common/baseRequest.ts

@@ -0,0 +1,83 @@
+import { HttpsProxyAgent } from 'hpagent'
+import fs from 'fs'
+import got, { Options } from 'got'
+import { Agents, HTTPSOptions } from 'got/dist/source/core'
+
+export function gotInstance(config: any) {
+  return got.extend({ retry: { limit: 0 }, ...buildBaseRequestOptions(config) })
+}
+
+export function buildBaseRequestOptions(config: any) {
+  const { apiKey, authorization } = config
+  const rejectUnauthorized = !config.certSelfSigned
+
+  const superApiKey = config.superApiKey
+  const superAuthToken = config.superAuthorization
+
+  const requestOptions = {
+    responseType: 'json',
+    forever: true,
+    uri: config.host,
+    followRedirect: false,
+    headers: {
+      'Content-Type': 'application/json; charset=utf-8',
+      Authorization: authorization,
+      'API-Key': apiKey,
+      SuperAuthorization: superAuthToken,
+      'Super-API-Key': superApiKey,
+      'User-Agent': 'contrast-cli-v2'
+    },
+    agent: getAgent(config)
+  } as Options
+
+  requestOptions.https = {
+    rejectUnauthorized: rejectUnauthorized
+  }
+
+  maybeAddCertsToRequest(config, requestOptions.https)
+  return requestOptions
+}
+
+function getAgent(config: any) {
+  return config.proxy
+    ? (new HttpsProxyAgent({ proxy: config.proxy }) as Agents)
+    : false
+}
+
+function maybeAddCertsToRequest(config: any, https: HTTPSOptions) {
+  // cacert
+  const caCertFilePath = config.cacert
+  if (caCertFilePath) {
+    try {
+      https.certificateAuthority = fs.readFileSync(caCertFilePath)
+    } catch (error: any) {
+      throw new Error(
+        `Unable to read CA from ${caCertFilePath}, msg: ${error.message}`
+      )
+    }
+  }
+
+  // cert
+  const certPath = config.cert
+  if (certPath) {
+    try {
+      https.certificate = fs.readFileSync(certPath)
+    } catch (error: any) {
+      throw new Error(
+        `Unable to read Certificate PEM file from config option contrast.api.certificate.cert_file='${certPath}', msg: ${error.message}`
+      )
+    }
+  }
+
+  // key
+  const keyPath = config.key
+  if (keyPath) {
+    try {
+      https.key = fs.readFileSync(keyPath)
+    } catch (error: any) {
+      throw new Error(
+        `Unable to read Key PEM file from config option contrast.api.certificate.key_file='${keyPath}', msg: ${error.message}`
+      )
+    }
+  }
+}

package/src/common/errorHandling.js

@@ -51,8 +51,8 @@ const maxAppError = () => {
 
 const parametersError = () => {
   generalError(
-    `Values not recognised`,
-    'Check your command & keys again for hidden characters.\nFor more information use contrast help.'
+    `Credentials not recognized`,
+    'Check your command & keys again for hidden characters / verify that the credentials are correct.\nFor more information use contrast help.'
   )
   process.exit(1)
 }

package/src/constants/constants.js

@@ -14,7 +14,7 @@ const HIGH = 'HIGH'
 const CRITICAL = 'CRITICAL'
 // App
 const APP_NAME = 'contrast'
-const APP_VERSION = '2.0.0'
+const APP_VERSION = '2.0.2-beta.0'
 const TIMEOUT = 120000
 const HIGH_COLOUR = '#ff9900'
 const CRITICAL_COLOUR = '#e35858'

package/src/index.ts

@@ -16,6 +16,7 @@ import {
 import { findCommandOnError } from './common/errorHandling'
 import { sendTelemetryConfigAsConfObj } from './telemetry/telemetry'
 import { processLearn } from './commands/learn/processLearn'
+import { processFingerprint } from './commands/github/processFingerprint'
 const {
   commandLineDefinitions: { mainUsageGuide, mainDefinition }
 } = constants
@@ -83,6 +84,10 @@ const start = async () => {
         return await processAudit(config, argvMain)
       }
 
+      if (command === 'fingerprint') {
+        return await processFingerprint(config, argvMain)
+      }
+
       if (command === 'learn') {
         return processLearn()
       }

package/src/scaAnalysis/common/auditReport.js

@@ -4,13 +4,20 @@ const {
 } = require('../../audit/report/commonReportingFunctions')
 const common = require('../../common/fail')
 const { printFormattedOutputSca } = require('./commonReportingFunctionsSca')
+const { auditSave } = require('../../audit/save')
 
-const processAuditReport = (config, reportModelList) => {
+const processAuditReport = async (config, reportModelList, reportId) => {
   let severityCounts = {}
   if (reportModelList !== undefined) {
     severityCounts = formatScaServicesReport(config, reportModelList)
   }
 
+  if (config.save !== undefined) {
+    await auditSave(config, reportId)
+  } else {
+    console.log('Use contrast audit --save to generate an SBOM')
+  }
+
   if (config.fail) {
     common.processFail(config, severityCounts)
   }

package/src/scaAnalysis/common/scaServicesUpload.js

@@ -14,8 +14,12 @@ const scaTreeUpload = async (analysis, config, reportSpinner) => {
   config.language = config.language === 'JAVASCRIPT' ? 'NODE' : config.language
   const startTime = performance.now()
   const timeout = commonApi.getTimeout(config)
+
+  const doINeedParent = config.repositoryId && config.language === 'JAVA'
+
   const requestBody = {
-    dependencyTree: analysis,
+    parentPom: doINeedParent ? analysis.parentPom : null,
+    dependencyTree: doINeedParent ? analysis.dependencyTree : analysis,
     organizationId: config.organizationId,
     language: config.language,
     tool: {

package/src/scaAnalysis/go/goReadDepFile.js

@@ -8,7 +8,10 @@ const getGoDependencies = config => {
   try {
     // A sample of this output can be found
     // in the go test folder data/goModGraphResults.text
-    cmdStdout = child_process.execSync('go mod graph', { cwd })
+    cmdStdout = child_process.execSync('go mod graph', {
+      cwd: cwd,
+      maxBuffer: 50 * 1024 * 1024
+    })
 
     return cmdStdout.toString()
   } catch (err) {
@@ -22,6 +25,7 @@ const getGoDependencies = config => {
     // throw new Error(
     //   i18n.__('goReadProjectFile', cwd, `${err.message ? err.message : ''}`)
     // )
+    process.exit(1)
   }
 }
 

package/src/scaAnalysis/java/analysis.js

@@ -30,7 +30,7 @@ const determineProjectTypeAndCwd = (files, config) => {
 
 const buildMaven = (config, projectData, timeout) => {
   let command = 'mvn'
-  let args = ['dependency:tree', '-B']
+  let args = ['dependency:tree', '-B', '-Dscope=runtime']
   if (config.mavenSettingsPath) {
     args.push('-s')
     args.push(config.mavenSettingsPath)

package/src/scaAnalysis/java/javaBuildDepsParser.js

@@ -140,7 +140,7 @@ const computeRelationToLastElement = element => {
 }
 
 const stripElement = element => {
-  return element
+  const initialStrippedElement = element
     .replace(/[|]/g, '')
     .replace('+---', '')
     .replace('\\---', '')
@@ -148,6 +148,22 @@ const stripElement = element => {
     .replace('(c)', '')
     .replace('->', '@')
     .replace('(*)', '')
+
+  //work out Gradle resolved versioning e.g. org.slf4j:slf4j-api:1.7.25 -> 1.7.22
+  //take 1.7.22
+  const splitElements = initialStrippedElement.split(':')
+  if (
+    splitElements[2] !== undefined &&
+    splitElements[2] !== null &&
+    splitElements[2].includes('@')
+  ) {
+    const splitVersions = splitElements[2].split('@')
+    return initialStrippedElement
+      .replace(':' + splitVersions[0], '')
+      .replace('@', ':')
+  }
+
+  return initialStrippedElement
 }
 
 const checkVersion = element => {

package/src/scaAnalysis/legacy/legacyFlow.js

@@ -32,11 +32,6 @@ const legacyFlow = async (config, messageToSend) => {
   succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'))
 
   await vulnerabilityReportV2(config, snapshotResponse.id)
-  if (config.save !== undefined) {
-    await auditSave(config)
-  } else {
-    console.log('\nUse contrast audit --save to generate an SBOM')
-  }
   const endTime = performance.now() - startTime
   const scanDurationMs = endTime - startTime
 

package/src/scaAnalysis/processServicesFlow.js

@@ -1,29 +1,119 @@
 const projectConfig = require('../commands/github/projectGroup')
+const repoService = require('../commands/github/repoServices')
 const scaServicesUpload = require('../scaAnalysis/common/scaServicesUpload')
-const processUpload = async (analysis, config, reportSpinner) => {
+
+const dealWithNoProjectId = async (analysis, config, reportSpinner) => {
+  await projectConfig.registerNewProjectGroup(config)
   let projectId = await projectConfig.getProjectIdByOrg(config)
+  await projectConfig.registerProjectIdOnCliServices(config, projectId)
+  config.projectId = projectId
+  return await scaServicesUpload.scaTreeUpload(analysis, config, reportSpinner)
+}
 
-  if (projectId === '') {
-    if (config.track === true) {
-      await projectConfig.registerNewProjectGroup(config)
-      projectId = await projectConfig.getProjectIdByOrg(config)
-    }
-
-    if (config.track === false || config.track === undefined) {
-      return await scaServicesUpload.noProjectUpload(
-        analysis,
-        config,
-        reportSpinner
-      )
-    }
+const repoProcess = async (analysis, config, reportSpinner) => {
+  if (config.debug || config.verbose) {
+    console.log('in repository process')
+    console.log('repository id: ', config.repositoryId)
+  }
+  if (config.repositoryId === '') {
+    console.log('Failed to retrieve Repository Id')
+    process.exit(1)
   }
 
-  await projectConfig.registerProjectIdOnCliServices(config, projectId)
-  config.projectId = projectId
+  let repoInfo = await repoService.retrieveProjectInfoViaRepoId(config)
+
+  repoInfo = repoInfo.find(
+    element =>
+      config.fileName === element.path &&
+      config.fileName === element.name &&
+      config.projectGroupId === element.projectGroupId
+  )
+
+  // console.log('repoInfo', repoInfo)
+
+  // if(repoInfo !== undefined) {
+  //   console.log('re-register / register first time')
+  //   const language  = repoInfo.language === 'JAVASCRIPT' ? 'NODE' : repoInfo.language
+  //   const additionalData = {
+  //     projectGroupId: repoInfo.projectGroupId,
+  //     projectGroupName: repoInfo.name,
+  //     projectLanguage: language,
+  //     projectType: 'REPOSITORY'
+  //   }
+  //
+  //   // check project exists in sca / register (just in case, it failed in the past)
+  //   await projectConfig.registerProjectIdOnCliServices(
+  //     config,
+  //     repoInfo.projectId,
+  //     additionalData
+  //   )
+  // }
+
+  if (
+    config.projectGroupId &&
+    !repoInfo?.projectId &&
+    (repoInfo === undefined || repoInfo.length === 0)
+  ) {
+    console.log(
+      '*** has projectGroupId, no projectId and repo has no project found that matches'
+    )
+    repoInfo = await projectConfig.registerProjectWithGroupProjectId(config)
+    console.log('new registered group', repoInfo)
+    const language =
+      repoInfo.language === 'JAVASCRIPT' ? 'NODE' : repoInfo.language
+
+    // const additionalData = {
+    //   projectGroupId: repoInfo.projectGroupId,
+    //   projectGroupName: repoInfo.name,
+    //   projectLanguage: language,
+    //   projectType: 'REPOSITORY'
+    // }
+
+    await projectConfig.registerProjectIdOnCliServices(
+      config,
+      repoInfo.projectId
+    )
+  }
+  config.projectId = repoInfo.projectId
+  return await scaServicesUpload.scaTreeUpload(analysis, config, reportSpinner)
+}
 
+const trackProcess = async (analysis, config, reportSpinner) => {
+  let projectId = await projectConfig.getProjectIdByOrg(config)
+
+  if (projectId === '') {
+    return dealWithNoProjectId(analysis, config, reportSpinner)
+  }
+  config.projectId = projectId
+  // we can always register just in case but normally we exit when
+  await projectConfig.registerProjectIdOnCliServices(config, projectId)
   return await scaServicesUpload.scaTreeUpload(analysis, config, reportSpinner)
 }
 
+const processUpload = async (analysis, config, reportSpinner) => {
+  //  if repo but no repoId -> RegisterRepo -> GroupProjectFlow THEN scaTreeUpload
+  //  if cli tracked but no projectId -> registerNewProjectGroup THEN scaTreeUpload
+  //  if cli not tracked and no projectID -> noProjectUpload
+  //  if cli not tracked and projectID -> scaTreeUpload}
+
+  if (config.repositoryId) {
+    return repoProcess(analysis, config, reportSpinner)
+  }
+
+  if (config.track) {
+    return trackProcess(analysis, config, reportSpinner)
+  }
+
+  if (!config.track) {
+    return await scaServicesUpload.noProjectUpload(
+      analysis,
+      config,
+      reportSpinner
+    )
+  }
+}
+
 module.exports = {
-  processUpload
+  processUpload,
+  repoProcess
 }

package/src/scaAnalysis/repoMode/mavenParser.js

@@ -32,6 +32,7 @@ const parsePomFile = jsonPomFile => {
   let dependencyTree = {}
   let parsedVersion
   let dependencies
+
   jsonPomFile.project.hasOwnProperty('dependencies')
     ? (dependencies = jsonPomFile.project.dependencies[0].dependency)
     : (dependencies =
@@ -68,7 +69,29 @@ const parsePomFile = jsonPomFile => {
     }
     dependencyTree[depName] = parsedDependency
   }
-  return dependencyTree
+
+  const retrieveParent = getParentDependency(jsonPomFile)
+
+  return {
+    parentPom: retrieveParent,
+    dependencyTree
+  }
+}
+
+const getParentDependency = jsonPomFile => {
+  let parent = {}
+  jsonPomFile.project.hasOwnProperty('parent')
+    ? (parent = buildParent(jsonPomFile.project.parent))
+    : (parent = undefined)
+  return parent
+}
+
+const buildParent = parent => {
+  return {
+    group: parent[0].groupId[0],
+    name: parent[0].artifactId[0],
+    version: parent[0].version[0]
+  }
 }
 
 const getVersion = (pomFile, dependencyWithoutVersion) => {

package/src/scaAnalysis/scaAnalysis.js

@@ -10,7 +10,6 @@ const autoDetection = require('../scan/autoDetection')
 const rootFile = require('../audit/languageAnalysisEngine/getProjectRootFilenames')
 const path = require('path')
 const i18n = require('i18n')
-const auditSave = require('../audit/save')
 const { auditUsageGuide } = require('../commands/audit/help')
 const repoMode = require('./repoMode')
 const { dotNetAnalysis } = require('./dotnet')
@@ -37,6 +36,8 @@ const processSca = async config => {
     process.exit(0)
   }
 
+  config.repo = config.repositoryId !== undefined
+
   const projectStats = await rootFile.getProjectStats(config.file)
   let pathWithFile = projectStats.isFile()
 
@@ -46,7 +47,7 @@ const processSca = async config => {
     : config.file
 
   filesFound = await autoDetection.autoDetectAuditFilesAndLanguages(config.file)
-
+  filesFound = await autoDetection.detectPackageManager(filesFound)
   autoDetection.dealWithMultiJava(filesFound)
 
   if (filesFound.length > 1 && pathWithFile) {
@@ -59,6 +60,7 @@ const processSca = async config => {
   //check we have the language and call the right analyser
   let messageToSend = undefined
   if (filesFound.length === 1) {
+    config.packageManager = filesFound[0]?.packageManager
     switch (Object.keys(filesFound[0])[0]) {
       case JAVA:
         config.language = JAVA
@@ -131,12 +133,11 @@ const processSca = async config => {
       const reportModelLibraryList = convertGenericToTypedReportModelSca(
         reportResponse.reportArray
       )
-      auditReport.processAuditReport(config, reportModelLibraryList)
-      if (config.save !== undefined) {
-        await auditSave.auditSave(config, reportResponse.reportId)
-      } else {
-        console.log('Use contrast audit --save to generate an SBOM')
-      }
+      await auditReport.processAuditReport(
+        config,
+        reportModelLibraryList,
+        reportResponse.reportId
+      )
 
       succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'))
 

package/src/scan/autoDetection.js

@@ -3,13 +3,20 @@ const fileFinder = require('./fileUtils')
 const {
   supportedLanguages: { JAVA, GO, PYTHON, RUBY, JAVASCRIPT, NODE, PHP, DOTNET }
 } = require('../constants/constants')
-const autoDetectFingerprintInfo = async (filePath, depth) => {
+const autoDetectFingerprintInfo = async (filePath, depth, config) => {
   let complexObj = await fileFinder.findAllFiles(filePath, depth)
   let result = []
   let count = 0
   complexObj.forEach(i => {
     count++
-    result.push({ filePath: i, id: count.toString() })
+    if (!i.includes('package.json')) {
+      result.push({
+        filePath: i,
+        id: count.toString(),
+        repositoryId: config.repositoryId,
+        projectGroupId: config.projectGroupId
+      })
+    }
   })
 
   return result
@@ -29,7 +36,7 @@ const detectPackageManager = async array => {
       i['language'] = JAVA
       i['packageManager'] = 'GRADLE'
     }
-    if (i.filePath.includes('package.json')) {
+    if (i.filePath.includes('package-lock.json')) {
       i['language'] = JAVASCRIPT
       i['packageManager'] = 'NPM'
     }
@@ -39,15 +46,19 @@ const detectPackageManager = async array => {
     }
     if (i.filePath.includes('Pipfile')) {
       i['language'] = PYTHON
+      i['packageManager'] = 'PYPI'
     }
     if (i.filePath.includes('csproj')) {
       i['language'] = DOTNET
+      i['packageManager'] = 'NUGET'
     }
     if (i.filePath.includes('Gemfile')) {
       i['language'] = RUBY
+      i['packageManager'] = 'RUBYGEMS'
     }
     if (i.filePath.includes('go.mod')) {
       i['language'] = GO
+      i['packageManager'] = 'PKG'
     }
   })
   return array

package/src/scan/fileUtils.js

@@ -18,6 +18,7 @@ const findAllFiles = async (filePath, depth = 2) => {
       '**/build.gradle',
       '**/build.gradle.kts',
       '**/package.json',
+      '**/package-lock.json',
       '**/yarn.lock',
       '**/Pipfile',
       '**/*.csproj',
@@ -51,94 +52,107 @@ const findFilesJava = async (languagesFound, filePath, depth = 1) => {
   )
 
   if (result.length > 0) {
-    return languagesFound.push({ JAVA: result, language: 'JAVA' })
+    let lockFile = result.find(i => i.includes('pom') || i.includes('gradle'))
+    return languagesFound.push({
+      JAVA: result,
+      language: 'JAVA',
+      filePath: lockFile
+    })
   }
   return languagesFound
 }
 
-const findFilesJavascript = async (languagesFound, filePath) => {
+const findFilesJavascript = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(
     ['**/package.json', '**/yarn.lock', '**/package-lock.json'],
     {
       dot: false,
-      deep: 1,
+      deep: depth,
       onlyFiles: true,
       cwd: filePath ? filePath : process.cwd()
     }
   )
 
   if (result.length > 0) {
-    return languagesFound.push({ JAVASCRIPT: result, language: 'JAVASCRIPT' })
+    let lockFile = result.find(i => i.includes('lock'))
+    return languagesFound.push({
+      JAVASCRIPT: result,
+      language: 'JAVASCRIPT',
+      filePath: lockFile
+    })
   }
   return languagesFound
 }
 
-const findFilesPython = async (languagesFound, filePath) => {
+const findFilesPython = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/Pipfile.lock', '**/Pipfile'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ PYTHON: result })
+    return languagesFound.push({ PYTHON: result, filePath: 'Pipfile' })
   }
   return languagesFound
 }
 
-const findFilesGo = async (languagesFound, filePath) => {
+const findFilesGo = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/go.mod'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ GO: result })
+    return languagesFound.push({ GO: result, filePath: 'go.mod' })
   }
   return languagesFound
 }
 
-const findFilesRuby = async (languagesFound, filePath) => {
+const findFilesRuby = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/Gemfile', '**/Gemfile.lock'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ RUBY: result })
+    return languagesFound.push({ RUBY: result, filePath: 'Gemfile' })
   }
   return languagesFound
 }
 
-const findFilesPhp = async (languagesFound, filePath) => {
+const findFilesPhp = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/composer.json', '**/composer.lock'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ PHP: result })
+    return languagesFound.push({ PHP: result, filePath: 'composer.lock' })
   }
   return languagesFound
 }
 
-const findFilesDotNet = async (languagesFound, filePath) => {
+const findFilesDotNet = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/*.csproj', '**/packages.lock.json'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ DOTNET: result })
+    return languagesFound.push({
+      DOTNET: result,
+      filePath: 'packages.lock.json'
+    })
   }
   return languagesFound
 }

package/src/utils/paramsUtil/paramHandler.js

@@ -1,7 +1,10 @@
 const commandlineAuth = require('./commandlineParams')
 const configStoreParams = require('./configStoreParams')
 const envVariableParams = require('./envVariableParams')
-const { validateAuthParams } = require('../validationCheck')
+const {
+  validateAuthParams,
+  validateFingerprintParams
+} = require('../validationCheck')
 const i18n = require('i18n')
 
 const getAuth = params => {
@@ -21,4 +24,15 @@ const getAuth = params => {
   }
 }
 
-module.exports = { getAuth }
+const getFingerprint = params => {
+  if (validateFingerprintParams(params)) {
+    return params
+  } else {
+    console.log(
+      'missing fingerprint params please check repository-url and repository-name'
+    )
+    process.exit(1)
+  }
+}
+
+module.exports = { getAuth, getFingerprint }