@contrast/contrast 2.0.2-beta.0 → 2.0.2-beta.10

package/src/scaAnalysis/common/scaServicesUpload.js

@@ -1,155 +0,0 @@
-const commonApi = require('../../utils/commonApi')
-const { APP_VERSION } = require('../../constants/constants')
-const requestUtils = require('../../utils/requestUtils')
-const { performance } = require('perf_hooks')
-
-const scaTreeUpload = async (analysis, config, reportSpinner) => {
-  if (config.projectId === '') {
-    console.log(
-      'We were unable to create/locate a project for this manifest, please try again or run with --debug for more information'
-    )
-    process.exit(1)
-  }
-
-  config.language = config.language === 'JAVASCRIPT' ? 'NODE' : config.language
-  const startTime = performance.now()
-  const timeout = commonApi.getTimeout(config)
-
-  const doINeedParent = config.repositoryId && config.language === 'JAVA'
-
-  const requestBody = {
-    parentPom: doINeedParent ? analysis.parentPom : null,
-    dependencyTree: doINeedParent ? analysis.dependencyTree : analysis,
-    organizationId: config.organizationId,
-    language: config.language,
-    tool: {
-      name: 'Contrast Codesec',
-      version: APP_VERSION
-    }
-  }
-
-  if (config.branch) {
-    requestBody.branchName = config.branch
-  }
-
-  const client = commonApi.getHttpClient(config)
-  const reportID = await client
-    .scaServiceIngest(requestBody, config)
-    .then(res => {
-      if (res.statusCode === 201 || res.statusCode === 200) {
-        return res.body.libraryIngestJobId
-      } else {
-        throw new Error(res.statusCode + ` error ingesting dependencies`)
-      }
-    })
-    .catch(err => {
-      throw err
-    })
-  if (config.debug) {
-    console.log(' polling report', reportID)
-  }
-
-  let keepChecking = true
-  let res
-  while (keepChecking) {
-    res = await client.scaServiceReportStatus(config, reportID).then(res => {
-      if (config.debug) {
-        console.log('scaServiceReportStatus', res.statusCode)
-        console.log(res.body)
-      }
-      if (res.body.status === 'COMPLETED') {
-        keepChecking = false
-        return client.scaServiceReport(config, reportID).then(res => {
-          const reportBody = res.body
-          return { reportBody, reportId: reportID }
-        })
-      }
-    })
-
-    if (!keepChecking) {
-      return { reportArray: res.reportBody, reportId: reportID }
-    }
-
-    commonApi.handleTimeout(startTime, timeout, reportSpinner)
-
-    await requestUtils.sleep(5000)
-  }
-
-  return { reportArray: res, reportID }
-}
-
-const noProjectUpload = async (analysis, config, reportSpinner) => {
-  config.language = config.language === 'JAVASCRIPT' ? 'NODE' : config.language
-  const startTime = performance.now()
-  const timeout = commonApi.getTimeout(config)
-  const requestBody = {
-    dependencyTree: analysis,
-    language: config.language,
-    tool: {
-      name: 'Contrast Codesec',
-      version: APP_VERSION
-    }
-  }
-
-  if (config.branch) {
-    requestBody.branchName = config.branch
-  }
-
-  const client = commonApi.getHttpClient(config)
-  const reportID = await client
-    .noProjectIdUpload(requestBody, config)
-    .then(res => {
-      if (res.statusCode === 201 || res.statusCode === 200) {
-        return res.body.libraryIngestJobId
-      } else {
-        throw new Error(
-          res.statusCode + ` error ingesting dependencies with no project id`
-        )
-      }
-    })
-    .catch(err => {
-      throw err
-    })
-
-  if (config.debug) {
-    console.log(' polling report no project', reportID)
-  }
-
-  let keepChecking = true
-  let res
-  while (keepChecking) {
-    res = await client
-      .scaServiceNoProjectIdReportStatus(config, reportID)
-      .then(res => {
-        if (config.debug) {
-          console.log('\nscaServiceReportStatus')
-          console.log(res.statusCode)
-          console.log(res.body)
-        }
-        if (res.body.status === 'COMPLETED') {
-          keepChecking = false
-          return client
-            .scaServiceReportNoProjectId(config, reportID)
-            .then(res => {
-              const reportBody = res.body
-              return { reportBody, reportId: reportID }
-            })
-        }
-      })
-
-    if (!keepChecking) {
-      return { reportArray: res.reportBody, reportId: reportID }
-    }
-
-    commonApi.handleTimeout(startTime, timeout, reportSpinner)
-
-    await requestUtils.sleep(5000)
-  }
-
-  return { reportArray: res, reportID }
-}
-
-module.exports = {
-  scaTreeUpload,
-  noProjectUpload
-}

package/src/scaAnalysis/common/treeUpload.js

@@ -1,51 +0,0 @@
-const commonApi = require('../../utils/commonApi')
-const { APP_VERSION } = require('../../constants/constants')
-
-const commonSendSnapShot = async (analysis, config) => {
-  let requestBody = {}
-  config.legacy === false
-    ? (requestBody = sendToSCAServices(config, analysis))
-    : (requestBody = {
-        appID: config.applicationId,
-        cliVersion: APP_VERSION,
-        snapshot: analysis
-      })
-
-  const client = commonApi.getHttpClient(config)
-  return client
-    .sendSnapshot(requestBody, config)
-    .then(res => {
-      if (res.statusCode === 201) {
-        return res.body
-      } else {
-        if (res.statusCode === 403) {
-          throw new Error(
-            `🛑 Contrast audit failed \nPlease check you have the right permissions and the application ${
-              config.applicationName ? config.applicationName : ''
-            } has not been archived.`.replace(/ +(?= )/g, '')
-          )
-        }
-        throw new Error(res.statusCode + ` error processing dependencies`)
-      }
-    })
-    .catch(err => {
-      throw err
-    })
-}
-
-const sendToSCAServices = (config, analysis) => {
-  return {
-    applicationId: config.applicationId,
-    dependencyTree: analysis,
-    organizationId: config.organizationId,
-    language: config.language,
-    tool: {
-      name: 'Contrast Codesec',
-      version: APP_VERSION
-    }
-  }
-}
-
-module.exports = {
-  commonSendSnapShot
-}

package/src/scaAnalysis/common/utils/reportUtilsSca.ts

@@ -1,123 +0,0 @@
-import { orderBy } from 'lodash'
-import {
-  CRITICAL_COLOUR,
-  CRITICAL_PRIORITY,
-  HIGH_COLOUR,
-  HIGH_PRIORITY,
-  LOW_COLOUR,
-  LOW_PRIORITY,
-  MEDIUM_COLOUR,
-  MEDIUM_PRIORITY,
-  NOTE_COLOUR,
-  NOTE_PRIORITY
-} from '../../../constants/constants'
-import { ReportSeverityModel } from '../../../audit/report/models/reportSeverityModel'
-import { SeverityCountModel } from '../../../audit/report/models/severityCountModel'
-import {
-  ScaReportModel,
-  ScaReportVulnerabilityModel
-} from '../models/ScaReportModel'
-
-export function findHighestSeverityCVESca(
-  cveArray: ScaReportVulnerabilityModel[]
-) {
-  const mappedToReportSeverityModels = cveArray.map(cve =>
-    findCVESeveritySca(cve)
-  )
-
-  //order and get first
-  return orderBy(mappedToReportSeverityModels, cve => cve?.priority)[0]
-}
-
-export function orderByHighestPrioritySca(
-  reportSeverityModel: ReportSeverityModel[]
-) {
-  return orderBy(reportSeverityModel, ['priority'], ['asc'])
-}
-
-export function findCVESeveritySca(
-  vulnerabilityModel: ScaReportVulnerabilityModel
-) {
-  const { name } = vulnerabilityModel
-
-  if (
-    vulnerabilityModel.cvss3Severity === 'CRITICAL' ||
-    vulnerabilityModel.severity === 'CRITICAL'
-  ) {
-    return new ReportSeverityModel(
-      'CRITICAL',
-      CRITICAL_PRIORITY,
-      CRITICAL_COLOUR,
-      name
-    )
-  } else if (
-    vulnerabilityModel.cvss3Severity === 'HIGH' ||
-    vulnerabilityModel.severity === 'HIGH'
-  ) {
-    return new ReportSeverityModel('HIGH', HIGH_PRIORITY, HIGH_COLOUR, name)
-  } else if (
-    vulnerabilityModel.cvss3Severity === 'MEDIUM' ||
-    vulnerabilityModel.severity === 'MEDIUM'
-  ) {
-    return new ReportSeverityModel(
-      'MEDIUM',
-      MEDIUM_PRIORITY,
-      MEDIUM_COLOUR,
-      name
-    )
-  } else if (
-    vulnerabilityModel.cvss3Severity === 'LOW' ||
-    vulnerabilityModel.severity === 'LOW'
-  ) {
-    return new ReportSeverityModel('LOW', LOW_PRIORITY, LOW_COLOUR, name)
-  } else if (
-    vulnerabilityModel.cvss3Severity === 'NOTE' ||
-    vulnerabilityModel.severity === 'NOTE'
-  ) {
-    return new ReportSeverityModel('NOTE', NOTE_PRIORITY, NOTE_COLOUR, name)
-  }
-}
-
-export function convertGenericToTypedReportModelSca(reportArray: any) {
-  return reportArray.map((library: any) => {
-    return new ScaReportModel(library)
-  })
-}
-
-export function severityCountAllLibrariesSca(
-  vulnerableLibraries: ScaReportModel[],
-  severityCount: SeverityCountModel
-) {
-  vulnerableLibraries.forEach(lib =>
-    severityCountAllCVEsSca(lib.vulnerabilities, severityCount)
-  )
-  return severityCount
-}
-
-export function severityCountAllCVEsSca(
-  cveArray: ScaReportVulnerabilityModel[],
-  severityCount: SeverityCountModel
-) {
-  const severityCountInner = severityCount
-  cveArray.forEach(cve => severityCountSingleCVESca(cve, severityCountInner))
-  return severityCountInner
-}
-
-export function severityCountSingleCVESca(
-  cve: ScaReportVulnerabilityModel,
-  severityCount: SeverityCountModel
-) {
-  if (cve.cvss3Severity === 'CRITICAL' || cve.severity === 'CRITICAL') {
-    severityCount.critical += 1
-  } else if (cve.cvss3Severity === 'HIGH' || cve.severity === 'HIGH') {
-    severityCount.high += 1
-  } else if (cve.cvss3Severity === 'MEDIUM' || cve.severity === 'MEDIUM') {
-    severityCount.medium += 1
-  } else if (cve.cvss3Severity === 'LOW' || cve.severity === 'LOW') {
-    severityCount.low += 1
-  } else if (cve.cvss3Severity === 'NOTE' || cve.severity === 'NOTE') {
-    severityCount.note += 1
-  }
-
-  return severityCount
-}

package/src/scaAnalysis/dotnet/analysis.js

@@ -1,72 +0,0 @@
-const fs = require('fs')
-const xml2js = require('xml2js')
-const i18n = require('i18n')
-
-const readAndParseProjectFile = projectFilePath => {
-  const projectFile = fs.readFileSync(projectFilePath)
-
-  return new xml2js.Parser({
-    explicitArray: false,
-    mergeAttrs: true
-  }).parseString(projectFile)
-}
-
-const readAndParseLockFile = lockFilePath => {
-  const lockFile = JSON.parse(fs.readFileSync(lockFilePath).toString())
-
-  let count = 0 // Used to test if some nodes are deleted
-
-  for (const dependenciesNode in lockFile.dependencies) {
-    for (const innerNode in lockFile.dependencies[dependenciesNode]) {
-      const nodeValidation = JSON.stringify(
-        lockFile.dependencies[dependenciesNode][innerNode]
-      )
-      if (nodeValidation.includes('"type":"Project"')) {
-        count += 1
-        delete lockFile.dependencies[dependenciesNode][innerNode]
-        lockFile.additionalInfo = 'dependenciesNote'
-      }
-    }
-  }
-
-  if (count > 0) {
-    const multiLevelProjectWarning = () => {
-      console.log('')
-      console.log(i18n.__('dependenciesNote'))
-    }
-    setTimeout(multiLevelProjectWarning, 7000)
-  }
-
-  return lockFile
-}
-
-const checkForCorrectFiles = languageFiles => {
-  if (!languageFiles.includes('packages.lock.json')) {
-    throw new Error(i18n.__('languageAnalysisHasNoLockFile', '.NET'))
-  }
-
-  if (!languageFiles.some(i => i.includes('.csproj'))) {
-    throw new Error(i18n.__('languageAnalysisProjectFileError', '.NET'))
-  }
-}
-
-const getDotNetDeps = (filePath, languageFiles) => {
-  checkForCorrectFiles(languageFiles)
-  const projectFileName = languageFiles.find(fileName =>
-    fileName.includes('.csproj')
-  )
-  const lockFileName = languageFiles.find(fileName =>
-    fileName.includes('.json')
-  )
-  const projectFile = readAndParseProjectFile(filePath + `/${projectFileName}`)
-  const lockFile = readAndParseLockFile(filePath + `/${lockFileName}`)
-
-  return { projectFile, lockFile }
-}
-
-module.exports = {
-  getDotNetDeps,
-  readAndParseProjectFile,
-  readAndParseLockFile,
-  checkForCorrectFiles
-}

package/src/scaAnalysis/dotnet/index.js

@@ -1,11 +0,0 @@
-const { getDotNetDeps } = require('./analysis')
-const { createDotNetTSMessage } = require('../common/formatMessage')
-
-const dotNetAnalysis = (config, languageFiles) => {
-  const dotNetDeps = getDotNetDeps(config.file, languageFiles.DOTNET)
-  return createDotNetTSMessage(dotNetDeps)
-}
-
-module.exports = {
-  dotNetAnalysis
-}

package/src/scaAnalysis/go/goAnalysis.js

@@ -1,26 +0,0 @@
-const { createGoTSMessage } = require('../common/formatMessage')
-const {
-  parseDependenciesForSCAServices
-} = require('../common/scaParserForGoAndJava')
-const goReadDepFile = require('./goReadDepFile')
-const goParseDeps = require('./goParseDeps')
-
-const goAnalysis = config => {
-  try {
-    const rawGoDependencies = goReadDepFile.getGoDependencies(config)
-    const parsedGoDependencies =
-      goParseDeps.parseGoDependencies(rawGoDependencies)
-
-    if (config.legacy === false) {
-      return parseDependenciesForSCAServices(parsedGoDependencies)
-    } else {
-      return createGoTSMessage(parsedGoDependencies)
-    }
-  } catch (e) {
-    console.log(e.message.toString())
-  }
-}
-
-module.exports = {
-  goAnalysis
-}

package/src/scaAnalysis/go/goParseDeps.js

@@ -1,203 +0,0 @@
-const crypto = require('crypto')
-
-const parseGoDependencies = goDeps => {
-  return parseGo(goDeps)
-}
-
-const parseGo = modGraphOutput => {
-  let splitLines = splitAllLinesIntoArray(modGraphOutput)
-  const directDepNames = getDirectDepNames(splitLines)
-  const uniqueTransitiveDepNames = getAllUniqueTransitiveDepNames(
-    splitLines,
-    directDepNames
-  )
-
-  let rootNodes = createRootNodes(splitLines)
-
-  createTransitiveDeps(uniqueTransitiveDepNames, splitLines, rootNodes)
-
-  return rootNodes
-}
-
-const splitAllLinesIntoArray = modGraphOutput => {
-  return modGraphOutput.split(/\r\n|\r|\n/)
-}
-
-const getAllDepsOfADepAsEdge = (dep, deps) => {
-  let edges = {}
-
-  const depRows = deps.filter(line => {
-    return line.startsWith(dep)
-  })
-
-  depRows.forEach(dep => {
-    const edgeName = dep.split(' ')[1]
-    edges[edgeName] = edgeName
-  })
-
-  return edges
-}
-
-const getAllDepsOfADepAsName = (dep, deps) => {
-  let edges = []
-
-  const depRows = deps.filter(line => {
-    return line.startsWith(dep)
-  })
-
-  depRows.forEach(dep => {
-    const edgeName = dep.split(' ')[1]
-    edges.push(edgeName)
-  })
-
-  return edges
-}
-
-const createRootNodes = deps => {
-  let rootDep = {}
-  const rootDeps = getRootDeps(deps)
-
-  const edges = rootDeps.map(dep => {
-    return dep.split(' ')[1]
-  })
-
-  rootDep[rootDeps[0].split(' ')[0]] = {}
-
-  edges.forEach(edge => {
-    const splitEdge = edge.split('@')
-    const splitGroupName = splitEdge[0].split('/')
-    const name = splitGroupName.pop()
-    const lastSlash = splitEdge[0].lastIndexOf('/')
-    let group = splitEdge[0].substring(0, lastSlash)
-    const hash = getHash(splitEdge[0])
-
-    group = checkGroupExists(group, name)
-
-    //get the edges of the root dependency
-    const edgesOfDep = getAllDepsOfADepAsEdge(edge, deps)
-
-    rootDep[rootDeps[0].split(' ')[0]][edge] = {
-      artifactID: name,
-      group: group,
-      version: splitEdge[1],
-      scope: '"compile',
-      type: 'direct',
-      hash: hash,
-      edges: edgesOfDep
-    }
-  })
-  return rootDep
-}
-
-const getRootDeps = deps => {
-  const rootDeps = deps.filter(dep => {
-    const parentDep = dep.split(' ')[0]
-    if (parentDep.split('@v').length === 1) {
-      return dep
-    }
-  })
-  return rootDeps
-}
-
-const getHash = library => {
-  let shaSum = crypto.createHash('sha1')
-  shaSum.update(library)
-  return shaSum.digest('hex')
-}
-
-const getDirectDepNames = deps => {
-  const directDepNames = []
-
-  deps.forEach(dep => {
-    const parentDep = dep.split(' ')[0]
-    if (parentDep.split('@v').length === 1) {
-      dep.split(' ')[1] !== undefined
-        ? directDepNames.push(dep.split(' ')[1])
-        : null
-    }
-  })
-  return directDepNames
-}
-
-const getAllUniqueTransitiveDepNames = (deps, directDepNames) => {
-  let uniqueDeps = []
-
-  deps.forEach(dep => {
-    const parentDep = dep.split(' ')[0]
-    if (parentDep.split('@v').length !== 1) {
-      if (!directDepNames.includes(parentDep)) {
-        if (!uniqueDeps.includes(parentDep)) {
-          parentDep.length > 1 ? uniqueDeps.push(parentDep) : null
-        }
-      }
-    }
-  })
-  return uniqueDeps
-}
-
-const checkGroupExists = (group, name) => {
-  if (group === null || group === '') {
-    return name
-  }
-  return group
-}
-
-const createTransitiveDeps = (transitiveDeps, splitLines, rootNodes) => {
-  transitiveDeps.forEach(dep => {
-    //create transitive dep
-    const splitEdge = dep.split('@')
-    const splitGroupName = splitEdge[0].split('/')
-    const name = splitGroupName.pop()
-    const lastSlash = splitEdge[0].lastIndexOf('/')
-    let group = splitEdge[0].substring(0, lastSlash)
-    const hash = getHash(splitEdge[0])
-
-    group = checkGroupExists(group, name)
-
-    const transitiveDep = {
-      artifactID: name,
-      group: group,
-      version: splitEdge[1],
-      scope: 'compile',
-      type: 'transitive',
-      hash: hash,
-      edges: {}
-    }
-
-    //add edges to transitiveDep
-    const edges = getAllDepsOfADepAsEdge(dep, splitLines)
-    transitiveDep.edges = edges
-
-    //add all edges as a transitive dependency to rootNodes
-    const edgesAsName = getAllDepsOfADepAsName(dep, splitLines)
-
-    edgesAsName.forEach(dep => {
-      const splitEdge = dep.split('@')
-      const splitGroupName = splitEdge[0].split('/')
-      const name = splitGroupName.pop()
-      const lastSlash = splitEdge[0].lastIndexOf('/')
-      let group = splitEdge[0].substring(0, lastSlash)
-      const hash = getHash(splitEdge[0])
-
-      group = checkGroupExists(group, name)
-
-      const transitiveDep = {
-        artifactID: name,
-        group: group,
-        version: splitEdge[1],
-        scope: 'compile',
-        type: 'transitive',
-        hash: hash,
-        edges: {}
-      }
-      rootNodes[Object.keys(rootNodes)[0]][dep] = transitiveDep
-    })
-
-    //add transitive dependency to rootNodes
-    rootNodes[Object.keys(rootNodes)[0]][dep] = transitiveDep
-  })
-}
-
-module.exports = {
-  parseGoDependencies
-}

package/src/scaAnalysis/go/goReadDepFile.js

@@ -1,34 +0,0 @@
-const child_process = require('child_process')
-const i18n = require('i18n')
-
-const getGoDependencies = config => {
-  let cmdStdout
-  let cwd = config.file ? config.file.replace('go.mod', '') : process.cwd()
-
-  try {
-    // A sample of this output can be found
-    // in the go test folder data/goModGraphResults.text
-    cmdStdout = child_process.execSync('go mod graph', {
-      cwd: cwd,
-      maxBuffer: 50 * 1024 * 1024
-    })
-
-    return cmdStdout.toString()
-  } catch (err) {
-    if (err.message === 'spawnSync /bin/sh ENOENT') {
-      err.message =
-        '\n\n*************** No transitive dependencies ***************\n\nWe are unable to build a dependency tree view from your repository as there were no transitive dependencies found.'
-    }
-    console.log(
-      i18n.__('goReadProjectFile', cwd, `${err.message ? err.message : ''}`)
-    )
-    // throw new Error(
-    //   i18n.__('goReadProjectFile', cwd, `${err.message ? err.message : ''}`)
-    // )
-    process.exit(1)
-  }
-}
-
-module.exports = {
-  getGoDependencies
-}