@contrast/contrast 2.0.1 → 2.0.2-beta.0

package/src/scaAnalysis/legacy/legacyFlow.js

@@ -32,11 +32,6 @@ const legacyFlow = async (config, messageToSend) => {
   succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'))
 
   await vulnerabilityReportV2(config, snapshotResponse.id)
-  if (config.save !== undefined) {
-    await auditSave(config)
-  } else {
-    console.log('\nUse contrast audit --save to generate an SBOM')
-  }
   const endTime = performance.now() - startTime
   const scanDurationMs = endTime - startTime
 

package/src/scaAnalysis/processServicesFlow.js

@@ -1,7 +1,8 @@
 const projectConfig = require('../commands/github/projectGroup')
+const repoService = require('../commands/github/repoServices')
 const scaServicesUpload = require('../scaAnalysis/common/scaServicesUpload')
 
-const trackProcess = async (analysis, config, reportSpinner) => {
+const dealWithNoProjectId = async (analysis, config, reportSpinner) => {
   await projectConfig.registerNewProjectGroup(config)
   let projectId = await projectConfig.getProjectIdByOrg(config)
   await projectConfig.registerProjectIdOnCliServices(config, projectId)
@@ -10,29 +11,83 @@ const trackProcess = async (analysis, config, reportSpinner) => {
 }
 
 const repoProcess = async (analysis, config, reportSpinner) => {
-  let repoInfo = repoService.retrieveRepoId(config)
-  if (repoInfo.repoId === '') {
-    repoInfo = repoService.registerRepo(config)
+  if (config.debug || config.verbose) {
+    console.log('in repository process')
+    console.log('repository id: ', config.repositoryId)
+  }
+  if (config.repositoryId === '') {
+    console.log('Failed to retrieve Repository Id')
+    process.exit(1)
   }
-  await projectConfig.registerProjectIdOnCliServices(config, repoInfo.projectId)
-  return repoInfo
-}
 
-const dealWithNoProjectId = async (analysis, config, reportSpinner) => {
-  // if (config.repo === '') {
-  //   return repoProcess(analysis, config, reportSpinner)
+  let repoInfo = await repoService.retrieveProjectInfoViaRepoId(config)
+
+  repoInfo = repoInfo.find(
+    element =>
+      config.fileName === element.path &&
+      config.fileName === element.name &&
+      config.projectGroupId === element.projectGroupId
+  )
+
+  // console.log('repoInfo', repoInfo)
+
+  // if(repoInfo !== undefined) {
+  //   console.log('re-register / register first time')
+  //   const language  = repoInfo.language === 'JAVASCRIPT' ? 'NODE' : repoInfo.language
+  //   const additionalData = {
+  //     projectGroupId: repoInfo.projectGroupId,
+  //     projectGroupName: repoInfo.name,
+  //     projectLanguage: language,
+  //     projectType: 'REPOSITORY'
+  //   }
+  //
+  //   // check project exists in sca / register (just in case, it failed in the past)
+  //   await projectConfig.registerProjectIdOnCliServices(
+  //     config,
+  //     repoInfo.projectId,
+  //     additionalData
+  //   )
   // }
-  if (config.track) {
-    return trackProcess(analysis, config, reportSpinner)
-  }
 
-  if (!config.track) {
-    return await scaServicesUpload.noProjectUpload(
-      analysis,
+  if (
+    config.projectGroupId &&
+    !repoInfo?.projectId &&
+    (repoInfo === undefined || repoInfo.length === 0)
+  ) {
+    console.log(
+      '*** has projectGroupId, no projectId and repo has no project found that matches'
+    )
+    repoInfo = await projectConfig.registerProjectWithGroupProjectId(config)
+    console.log('new registered group', repoInfo)
+    const language =
+      repoInfo.language === 'JAVASCRIPT' ? 'NODE' : repoInfo.language
+
+    // const additionalData = {
+    //   projectGroupId: repoInfo.projectGroupId,
+    //   projectGroupName: repoInfo.name,
+    //   projectLanguage: language,
+    //   projectType: 'REPOSITORY'
+    // }
+
+    await projectConfig.registerProjectIdOnCliServices(
       config,
-      reportSpinner
+      repoInfo.projectId
     )
   }
+  config.projectId = repoInfo.projectId
+  return await scaServicesUpload.scaTreeUpload(analysis, config, reportSpinner)
+}
+
+const trackProcess = async (analysis, config, reportSpinner) => {
+  let projectId = await projectConfig.getProjectIdByOrg(config)
+
+  if (projectId === '') {
+    return dealWithNoProjectId(analysis, config, reportSpinner)
+  }
+  config.projectId = projectId
+  // we can always register just in case but normally we exit when
+  await projectConfig.registerProjectIdOnCliServices(config, projectId)
+  return await scaServicesUpload.scaTreeUpload(analysis, config, reportSpinner)
 }
 
 const processUpload = async (analysis, config, reportSpinner) => {
@@ -40,15 +95,17 @@ const processUpload = async (analysis, config, reportSpinner) => {
   //  if cli tracked but no projectId -> registerNewProjectGroup THEN scaTreeUpload
   //  if cli not tracked and no projectID -> noProjectUpload
   //  if cli not tracked and projectID -> scaTreeUpload}
-  let projectId = await projectConfig.getProjectIdByOrg(config)
 
-  if (projectId === '') {
-    return dealWithNoProjectId(analysis, config, reportSpinner)
+  if (config.repositoryId) {
+    return repoProcess(analysis, config, reportSpinner)
   }
 
-  if (projectId) {
-    config.projectId = projectId
-    return await scaServicesUpload.scaTreeUpload(
+  if (config.track) {
+    return trackProcess(analysis, config, reportSpinner)
+  }
+
+  if (!config.track) {
+    return await scaServicesUpload.noProjectUpload(
       analysis,
       config,
       reportSpinner
@@ -57,5 +114,6 @@ const processUpload = async (analysis, config, reportSpinner) => {
 }
 
 module.exports = {
-  processUpload
+  processUpload,
+  repoProcess
 }

package/src/scaAnalysis/repoMode/mavenParser.js

@@ -32,6 +32,7 @@ const parsePomFile = jsonPomFile => {
   let dependencyTree = {}
   let parsedVersion
   let dependencies
+
   jsonPomFile.project.hasOwnProperty('dependencies')
     ? (dependencies = jsonPomFile.project.dependencies[0].dependency)
     : (dependencies =
@@ -68,7 +69,29 @@ const parsePomFile = jsonPomFile => {
     }
     dependencyTree[depName] = parsedDependency
   }
-  return dependencyTree
+
+  const retrieveParent = getParentDependency(jsonPomFile)
+
+  return {
+    parentPom: retrieveParent,
+    dependencyTree
+  }
+}
+
+const getParentDependency = jsonPomFile => {
+  let parent = {}
+  jsonPomFile.project.hasOwnProperty('parent')
+    ? (parent = buildParent(jsonPomFile.project.parent))
+    : (parent = undefined)
+  return parent
+}
+
+const buildParent = parent => {
+  return {
+    group: parent[0].groupId[0],
+    name: parent[0].artifactId[0],
+    version: parent[0].version[0]
+  }
 }
 
 const getVersion = (pomFile, dependencyWithoutVersion) => {

package/src/scaAnalysis/scaAnalysis.js

@@ -10,7 +10,6 @@ const autoDetection = require('../scan/autoDetection')
 const rootFile = require('../audit/languageAnalysisEngine/getProjectRootFilenames')
 const path = require('path')
 const i18n = require('i18n')
-const auditSave = require('../audit/save')
 const { auditUsageGuide } = require('../commands/audit/help')
 const repoMode = require('./repoMode')
 const { dotNetAnalysis } = require('./dotnet')
@@ -37,6 +36,8 @@ const processSca = async config => {
     process.exit(0)
   }
 
+  config.repo = config.repositoryId !== undefined
+
   const projectStats = await rootFile.getProjectStats(config.file)
   let pathWithFile = projectStats.isFile()
 
@@ -46,7 +47,7 @@ const processSca = async config => {
     : config.file
 
   filesFound = await autoDetection.autoDetectAuditFilesAndLanguages(config.file)
-
+  filesFound = await autoDetection.detectPackageManager(filesFound)
   autoDetection.dealWithMultiJava(filesFound)
 
   if (filesFound.length > 1 && pathWithFile) {
@@ -59,6 +60,7 @@ const processSca = async config => {
   //check we have the language and call the right analyser
   let messageToSend = undefined
   if (filesFound.length === 1) {
+    config.packageManager = filesFound[0]?.packageManager
     switch (Object.keys(filesFound[0])[0]) {
       case JAVA:
         config.language = JAVA
@@ -131,12 +133,11 @@ const processSca = async config => {
       const reportModelLibraryList = convertGenericToTypedReportModelSca(
         reportResponse.reportArray
       )
-      auditReport.processAuditReport(config, reportModelLibraryList)
-      if (config.save !== undefined) {
-        await auditSave.auditSave(config, reportResponse.reportId)
-      } else {
-        console.log('Use contrast audit --save to generate an SBOM')
-      }
+      await auditReport.processAuditReport(
+        config,
+        reportModelLibraryList,
+        reportResponse.reportId
+      )
 
       succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'))
 

package/src/scan/autoDetection.js

@@ -9,11 +9,14 @@ const autoDetectFingerprintInfo = async (filePath, depth, config) => {
   let count = 0
   complexObj.forEach(i => {
     count++
-    result.push({
-      filePath: i,
-      id: count.toString(),
-      repositoryId: config.repositoryId
-    })
+    if (!i.includes('package.json')) {
+      result.push({
+        filePath: i,
+        id: count.toString(),
+        repositoryId: config.repositoryId,
+        projectGroupId: config.projectGroupId
+      })
+    }
   })
 
   return result
@@ -43,15 +46,19 @@ const detectPackageManager = async array => {
     }
     if (i.filePath.includes('Pipfile')) {
       i['language'] = PYTHON
+      i['packageManager'] = 'PYPI'
     }
     if (i.filePath.includes('csproj')) {
       i['language'] = DOTNET
+      i['packageManager'] = 'NUGET'
     }
     if (i.filePath.includes('Gemfile')) {
       i['language'] = RUBY
+      i['packageManager'] = 'RUBYGEMS'
     }
     if (i.filePath.includes('go.mod')) {
       i['language'] = GO
+      i['packageManager'] = 'PKG'
     }
   })
   return array

package/src/scan/fileUtils.js

@@ -18,6 +18,7 @@ const findAllFiles = async (filePath, depth = 2) => {
       '**/build.gradle',
       '**/build.gradle.kts',
       '**/package.json',
+      '**/package-lock.json',
       '**/yarn.lock',
       '**/Pipfile',
       '**/*.csproj',
@@ -51,94 +52,107 @@ const findFilesJava = async (languagesFound, filePath, depth = 1) => {
   )
 
   if (result.length > 0) {
-    return languagesFound.push({ JAVA: result, language: 'JAVA' })
+    let lockFile = result.find(i => i.includes('pom') || i.includes('gradle'))
+    return languagesFound.push({
+      JAVA: result,
+      language: 'JAVA',
+      filePath: lockFile
+    })
   }
   return languagesFound
 }
 
-const findFilesJavascript = async (languagesFound, filePath) => {
+const findFilesJavascript = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(
     ['**/package.json', '**/yarn.lock', '**/package-lock.json'],
     {
       dot: false,
-      deep: 1,
+      deep: depth,
       onlyFiles: true,
       cwd: filePath ? filePath : process.cwd()
     }
   )
 
   if (result.length > 0) {
-    return languagesFound.push({ JAVASCRIPT: result, language: 'JAVASCRIPT' })
+    let lockFile = result.find(i => i.includes('lock'))
+    return languagesFound.push({
+      JAVASCRIPT: result,
+      language: 'JAVASCRIPT',
+      filePath: lockFile
+    })
   }
   return languagesFound
 }
 
-const findFilesPython = async (languagesFound, filePath) => {
+const findFilesPython = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/Pipfile.lock', '**/Pipfile'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ PYTHON: result })
+    return languagesFound.push({ PYTHON: result, filePath: 'Pipfile' })
   }
   return languagesFound
 }
 
-const findFilesGo = async (languagesFound, filePath) => {
+const findFilesGo = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/go.mod'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ GO: result })
+    return languagesFound.push({ GO: result, filePath: 'go.mod' })
   }
   return languagesFound
 }
 
-const findFilesRuby = async (languagesFound, filePath) => {
+const findFilesRuby = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/Gemfile', '**/Gemfile.lock'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ RUBY: result })
+    return languagesFound.push({ RUBY: result, filePath: 'Gemfile' })
   }
   return languagesFound
 }
 
-const findFilesPhp = async (languagesFound, filePath) => {
+const findFilesPhp = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/composer.json', '**/composer.lock'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ PHP: result })
+    return languagesFound.push({ PHP: result, filePath: 'composer.lock' })
   }
   return languagesFound
 }
 
-const findFilesDotNet = async (languagesFound, filePath) => {
+const findFilesDotNet = async (languagesFound, filePath, depth = 1) => {
   const result = await fg(['**/*.csproj', '**/packages.lock.json'], {
     dot: false,
-    deep: 3,
+    deep: depth,
     onlyFiles: true,
     cwd: filePath ? filePath : process.cwd()
   })
 
   if (result.length > 0) {
-    return languagesFound.push({ DOTNET: result })
+    return languagesFound.push({
+      DOTNET: result,
+      filePath: 'packages.lock.json'
+    })
   }
   return languagesFound
 }

package/src/utils/paramsUtil/paramHandler.js

@@ -1,7 +1,10 @@
 const commandlineAuth = require('./commandlineParams')
 const configStoreParams = require('./configStoreParams')
 const envVariableParams = require('./envVariableParams')
-const { validateAuthParams } = require('../validationCheck')
+const {
+  validateAuthParams,
+  validateFingerprintParams
+} = require('../validationCheck')
 const i18n = require('i18n')
 
 const getAuth = params => {
@@ -21,4 +24,15 @@ const getAuth = params => {
   }
 }
 
-module.exports = { getAuth }
+const getFingerprint = params => {
+  if (validateFingerprintParams(params)) {
+    return params
+  } else {
+    console.log(
+      'missing fingerprint params please check repository-url and repository-name'
+    )
+    process.exit(1)
+  }
+}
+
+module.exports = { getAuth, getFingerprint }

package/src/utils/validationCheck.js

@@ -27,8 +27,13 @@ const validateAuthParams = params => {
   )
 }
 
+const validateFingerprintParams = params => {
+  return !!(params.repositoryUrl && params.repositoryName)
+}
+
 module.exports = {
   checkConfigHasRequiredValues: checkConfigHasRequiredValues,
   validateAuthParams: validateAuthParams,
-  validateRequiredScanParams: validateRequiredScanParams
+  validateRequiredScanParams: validateRequiredScanParams,
+  validateFingerprintParams: validateFingerprintParams
 }

package/dist/utils/settingsHelper.js

@@ -1,14 +0,0 @@
-"use strict";
-const generalAPI = require('./generalAPI');
-const { SAAS } = require('../constants/constants');
-const getSettings = async (config) => {
-    config.isEOP =
-        (await generalAPI.getMode(config)).toUpperCase() === SAAS ? false : true;
-    if (config.legacy === undefined) {
-        config.legacy = config.isEOP;
-    }
-    return config;
-};
-module.exports = {
-    getSettings
-};

package/src/utils/settingsHelper.js

@@ -1,16 +0,0 @@
-const generalAPI = require('./generalAPI')
-const { SAAS } = require('../constants/constants')
-
-const getSettings = async config => {
-  config.isEOP =
-    (await generalAPI.getMode(config)).toUpperCase() === SAAS ? false : true
-
-  if (config.legacy === undefined) {
-    config.legacy = config.isEOP
-  }
-  return config
-}
-
-module.exports = {
-  getSettings
-}