@contrast/contrast 2.0.2-beta.0 → 2.0.2-beta.10

package/src/scan/models/resultContentModel.ts

@@ -1,86 +0,0 @@
-type Importance = 'important' | 'essential'
-
-interface ArtifactLocation {
-  uri: string
-}
-
-interface Region {
-  startLine: string
-  snippet: Snippet
-}
-
-interface Snippet {
-  text: string
-  rendered: Rendered
-}
-
-interface Rendered {
-  text: string
-}
-
-interface PhysicalLocation {
-  artifactLocation: ArtifactLocation
-  region: Region
-}
-
-interface LogicalLocation {
-  fullyQualifiedName: string
-  name: string
-}
-
-export interface Location {
-  physicalLocation: PhysicalLocation
-  logicalLocations?: LogicalLocation[]
-}
-
-export interface ThreadFlowLocation {
-  importance: Importance
-  location: Location
-}
-
-interface ThreadFlow {
-  locations: ThreadFlowLocation[]
-}
-
-interface Message {
-  text: string
-}
-
-export interface CodeFlow {
-  message: Message
-  threadFlows: ThreadFlow[]
-}
-
-export interface ResultContent {
-  message?: { text: string }
-  id: string
-  organizationId: string
-  projectId: string
-  firstCreatedTime: string
-  ruleId: string
-  codeFlows: CodeFlow[]
-  lastSeenTime: string
-  locations: Location[]
-  name: string
-  description: string
-  recommendation: string | null
-  risk: string | null
-  category: string
-  confidence: string
-  standards: { [key: string]: string[] }
-  cwe: string[]
-  owasp: string[]
-  reference: string[]
-  sink: string
-  detailsTrigger: string
-  type: RuleType
-  source: string
-  severity: Severity
-  advice: string
-  learn: string[]
-  issue: string
-}
-
-export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'note'
-
-export type RuleType = 'DATA_FLOW' | 'CRYPTO' | 'CONFIG' | 'DEFAULT'

package/src/scan/models/scanResultsModel.ts

@@ -1,55 +0,0 @@
-import { ResultContent } from './resultContentModel'
-
-export class ScanResultsModel {
-  projectOverview: ProjectOverview
-  scanDetail: ScanDetail
-  scanResultsInstances: ScanResultsInstances
-  newProject: boolean
-
-  constructor(scan: any) {
-    this.projectOverview = scan.projectOverview as ProjectOverview
-    this.scanDetail = scan.scanDetail as ScanDetail
-    this.scanResultsInstances =
-      scan.scanResultsInstances as ScanResultsInstances
-    this.newProject = scan.newProject
-  }
-}
-
-export interface ProjectOverview {
-  id: string
-  organizationId: string
-  name: string
-  archived: boolean
-  language: string
-  critical: number
-  high: number
-  medium: number
-  low: number
-  note: number
-  lastScanTime: string
-  completedScans: number
-  lastScanId: string
-}
-
-export interface ScanDetail {
-  critical: number
-  high: number
-  medium: number
-  low: number
-  note: number
-  id: string
-  organizationId: string
-  projectId: string
-  codeArtifactId: string
-  status: string
-  createdTime: string
-  startedTime: string
-  completedTime: string
-  language: string
-  label: string
-  errorMessage: string
-}
-
-export interface ScanResultsInstances {
-  content: ResultContent[]
-}

package/src/scan/populateProjectIdAndProjectName.js

@@ -1,73 +0,0 @@
-const commonApi = require('../utils/commonApi.js')
-const i18n = require('i18n')
-
-const populateProjectId = async config => {
-  const client = commonApi.getHttpClient(config)
-  let proj = await createProjectId(config, client)
-  if (proj === undefined) {
-    proj = await getExistingProjectIdByName(config, client).then(res => {
-      return res
-    })
-
-    return { projectId: proj, isNewProject: false }
-  }
-
-  return { projectId: proj, isNewProject: true }
-}
-
-const createProjectId = async (config, client) => {
-  return client
-    .createProjectId(config)
-    .then(res => {
-      if (res.statusCode === 409) {
-        console.log(i18n.__('foundExistingProjectScan'))
-        return
-      }
-      if (res.statusCode === 403) {
-        console.log(i18n.__('permissionsError'))
-        process.exit(1)
-        return
-      }
-      if (res.statusCode === 429) {
-        console.log(i18n.__('exceededFreeTier'))
-        process.exit(1)
-        return
-      }
-      if (res.statusCode === 201) {
-        console.log(i18n.__('projectCreatedScan'))
-        if (config.verbose) {
-          console.log(i18n.__('populateProjectIdMessage', res.body.id))
-        }
-        return res.body.id
-      }
-    })
-    .catch(err => {
-      if (config.verbose) {
-        console.log(err)
-      }
-      console.log(i18n.__('connectionError'))
-      process.exit(0)
-    })
-}
-
-const getExistingProjectIdByName = async (config, client) => {
-  return client
-    .getProjectIdByName(config)
-    .then(res => {
-      if (res.statusCode === 200) {
-        if (config.verbose) {
-          console.log(
-            i18n.__('populateProjectIdMessage', res.body.content[0].id)
-          )
-        }
-        return res.body.content[0].id
-      }
-    })
-    .catch(err => {
-      console.log(err)
-    })
-}
-
-module.exports = {
-  populateProjectId: populateProjectId
-}

package/src/scan/saveResults.js

@@ -1,14 +0,0 @@
-const fs = require('fs')
-
-const writeResultsToFile = async (responseBody, name = 'results.sarif') => {
-  try {
-    fs.writeFileSync(name, JSON.stringify(responseBody, null, 2))
-    return name
-  } catch (err) {
-    console.log('Error writing Scan Results to file')
-  }
-}
-
-module.exports = {
-  writeResultsToFile: writeResultsToFile
-}

package/src/scan/scan.ts

@@ -1,68 +0,0 @@
-import commonApi from '../utils/commonApi.js'
-import fileUtils from '../scan/fileUtils'
-import i18n from 'i18n'
-import oraWrapper from '../utils/oraWrapper'
-
-export const allowedFileTypes = ['.jar', '.war', '.js', '.zip', '.exe']
-
-export const isFileAllowed = (scanOption: string) => {
-  let valid = false
-  allowedFileTypes.forEach(fileType => {
-    if (scanOption.endsWith(fileType)) {
-      valid = true
-    }
-  })
-  return valid
-}
-
-export const sendScan = async (config: any) => {
-  if (!isFileAllowed(config.file)) {
-    console.log(i18n.__('scanErrorFileMessage'))
-    process.exit(9)
-  } else {
-    fileUtils.checkFilePermissions(config.file)
-    const client = commonApi.getHttpClient(config)
-
-    const startUploadSpinner = oraWrapper.returnOra(i18n.__('uploadingScan'))
-    oraWrapper.startSpinner(startUploadSpinner)
-
-    return await client
-      .sendArtifact(config)
-      .then(res => {
-        if (res.statusCode === 201) {
-          oraWrapper.succeedSpinner(
-            startUploadSpinner,
-            i18n.__('uploadingScanSuccessful')
-          )
-          if (config.verbose) {
-            console.log(i18n.__('responseMessage', res.body))
-          }
-          return res.body.id
-        } else {
-          if (config.debug) {
-            console.log(config)
-            oraWrapper.failSpinner(
-              startUploadSpinner,
-              i18n.__('uploadingScanFail')
-            )
-            console.log(i18n.__('genericServiceError', res.statusCode))
-          }
-          if (res.statusCode === 429) {
-            console.log(i18n.__('exceededFreeTier'))
-            process.exit(1)
-          }
-          if (res.statusCode === 403) {
-            console.log(i18n.__('permissionsError'))
-            process.exit(1)
-          }
-          oraWrapper.stopSpinner(startUploadSpinner)
-          console.log('Contrast Scan Finished')
-          process.exit(1)
-        }
-      })
-      .catch(err => {
-        oraWrapper.stopSpinner(startUploadSpinner)
-        console.log(err)
-      })
-  }
-}

package/src/scan/scanConfig.js

@@ -1,58 +0,0 @@
-const paramHandler = require('../utils/paramsUtil/paramHandler')
-const constants = require('../cliConstants.js')
-const path = require('path')
-const { supportedLanguagesScan } = require('../constants/constants')
-const i18n = require('i18n')
-const { scanUsageGuide } = require('./help')
-const parsedCLIOptions = require('../utils/parsedCLIOptions')
-
-const getScanConfig = async (contrastConf, command, argv) => {
-  let scanParams = await parsedCLIOptions.getCommandLineArgsCustom(
-    contrastConf,
-    command,
-    argv,
-    constants.commandLineDefinitions.scanOptionDefinitions
-  )
-
-  if (scanParams.help) {
-    printHelpMessage()
-    process.exit(0)
-  }
-
-  const paramsAuth = paramHandler.getAuth(scanParams)
-
-  if (scanParams.language) {
-    scanParams.language = scanParams.language.toUpperCase()
-    if (!Object.values(supportedLanguagesScan).includes(scanParams.language)) {
-      console.log(`Did not recognise --language ${scanParams.language}`)
-      console.log(i18n.__('constantsHowToRunDev3'))
-      process.exit(1)
-    }
-  }
-
-  // if no name, take the full file path and use it as the project name
-  let projectNameSource
-  if (!scanParams.name && scanParams.file) {
-    scanParams.name = getFileName(scanParams.file)
-    projectNameSource = 'AUTO'
-  } else {
-    projectNameSource = 'USER'
-  }
-
-  return { ...paramsAuth, ...scanParams, projectNameSource }
-}
-
-const getFileName = file => {
-  // from '/Users/x/y/spring-async.war' to 'spring-async.war'
-  return file.split(path.sep).pop()
-}
-
-const printHelpMessage = () => {
-  console.log(scanUsageGuide)
-}
-
-module.exports = {
-  getScanConfig,
-  getFileName,
-  printHelpMessage
-}

package/src/scan/scanController.js

@@ -1,98 +0,0 @@
-const i18n = require('i18n')
-const {
-  returnOra,
-  startSpinner,
-  succeedSpinner,
-  stopSpinner
-} = require('../utils/oraWrapper')
-const populateProjectIdAndProjectName = require('./populateProjectIdAndProjectName')
-const scan = require('./scan')
-const scanResults = require('./scanResults')
-const autoDetection = require('./autoDetection')
-const fileFunctions = require('./fileUtils')
-const { performance } = require('perf_hooks')
-
-const getTimeout = config => {
-  if (config.timeout) {
-    return config.timeout
-  } else {
-    if (config.verbose) {
-      console.log('Timeout set to 5 minutes')
-    }
-    return 300
-  }
-}
-
-const fileAndLanguageLogic = async configToUse => {
-  if (configToUse.file) {
-    if (!fileFunctions.fileExists(configToUse.file)) {
-      console.log(i18n.__('fileNotExist'))
-      process.exit(1)
-    }
-
-    if (fileFunctions.fileIsEmpty(configToUse.file)) {
-      console.log(i18n.__('scanFileIsEmpty'))
-      process.exit(1)
-    }
-    return configToUse
-  } else {
-    if (configToUse.file === undefined || configToUse.file === null) {
-      await autoDetection.autoDetectFileAndLanguage(configToUse)
-    }
-  }
-}
-
-const startScan = async configToUse => {
-  const startTime = performance.now()
-  await fileAndLanguageLogic(configToUse)
-
-  let newProject
-
-  if (!configToUse.projectId) {
-    const { projectId, isNewProject } =
-      await populateProjectIdAndProjectName.populateProjectId(configToUse)
-    configToUse.projectId = projectId
-    newProject = isNewProject
-  } else {
-    newProject = false
-  }
-  const codeArtifactId = await scan.sendScan(configToUse)
-
-  if (!configToUse.ff) {
-    const startScanSpinner = returnOra('🚀 Contrast Scan started')
-    startSpinner(startScanSpinner)
-    const scanDetail = await scanResults.returnScanResults(
-      configToUse,
-      codeArtifactId,
-      newProject,
-      getTimeout(configToUse),
-      startScanSpinner
-    )
-
-    const scanResultsInstances = await scanResults.returnScanResultsInstances(
-      configToUse,
-      scanDetail.id
-    )
-
-    const endTime = performance.now()
-    const scanDurationMs = endTime - startTime
-    if (scanResultsInstances.statusCode !== 200) {
-      stopSpinner(startScanSpinner)
-      console.log('Result Service is unavailable, please try again later')
-      process.exit(1)
-    } else {
-      succeedSpinner(startScanSpinner, 'Contrast Scan complete')
-      console.log(
-        `----- Scan completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`
-      )
-      return {
-        scanDetail,
-        scanResultsInstances: scanResultsInstances.body
-      }
-    }
-  }
-}
-
-module.exports = {
-  startScan: startScan
-}

package/src/scan/scanResults.js

@@ -1,171 +0,0 @@
-const commonApi = require('../utils/commonApi')
-const requestUtils = require('../../src/utils/requestUtils')
-const oraFunctions = require('../utils/oraWrapper')
-const _ = require('lodash')
-const i18n = require('i18n')
-const oraWrapper = require('../utils/oraWrapper')
-const readLine = require('readline')
-
-const getScanId = async (config, codeArtifactId, client) => {
-  return client
-    .getScanId(config, codeArtifactId)
-    .then(res => {
-      if (res.statusCode == 429) {
-        throw new Error(i18n.__('exceededFreeTier'))
-      }
-      return res.body.id
-    })
-    .catch(err => {
-      console.log(err)
-    })
-}
-
-const pollScanResults = async (config, scanId, client) => {
-  await requestUtils.sleep(5000)
-  return client
-    .getSpecificScanResult(config, scanId)
-    .then(res => {
-      return res
-    })
-    .catch(err => {
-      console.log(err)
-    })
-}
-
-const returnScanResults = async (
-  config,
-  codeArtifactId,
-  newProject,
-  timeout,
-  startScanSpinner
-) => {
-  const client = commonApi.getHttpClient(config)
-  let scanId = await getScanId(config, codeArtifactId, client)
-
-  // send metrics event to sast-event-collector
-  if (
-    process.env.CODESEC_INVOCATION_ENVIRONMENT &&
-    process.env.CODESEC_INVOCATION_ENVIRONMENT.toUpperCase() === 'GITHUB'
-  ) {
-    await client.createNewEvent(config, scanId, newProject)
-  }
-
-  let startTime = new Date()
-  let complete = false
-  if (!_.isNil(scanId)) {
-    while (!complete) {
-      let result = await pollScanResults(config, scanId, client)
-      if (JSON.stringify(result.statusCode) == 200) {
-        if (result.body.status === 'COMPLETED') {
-          complete = true
-          return result.body
-        }
-        if (result.body.status === 'FAILED') {
-          complete = true
-          if (config.debug) {
-            oraFunctions.failSpinner(
-              startScanSpinner,
-              i18n.__(
-                'scanNotCompleted',
-                'https://docs.contrastsecurity.com/en/binary-package-preparation.html'
-              )
-            )
-          }
-          if (
-            result?.body?.errorMessage ===
-            'Unable to determine language for code artifact'
-          ) {
-            console.log(result.body.errorMessage)
-            console.log(
-              'Try scanning again using --language param. ',
-              i18n.__('scanOptionsLanguageSummary')
-            )
-          }
-          oraWrapper.stopSpinner(startScanSpinner)
-          console.log('Contrast Scan Finished')
-          process.exit(1)
-        }
-      }
-      let endTime = new Date() - startTime
-      if (requestUtils.millisToSeconds(endTime) > timeout) {
-        oraFunctions.failSpinner(
-          startScanSpinner,
-          'Contrast Scan timed out at the specified ' + timeout + ' seconds.'
-        )
-
-        const isCI = process.env.CONTRAST_CODESEC_CI
-          ? JSON.parse(process.env.CONTRAST_CODESEC_CI.toLowerCase())
-          : false
-        if (!isCI) {
-          const retry = await retryScanPrompt()
-          timeout = retry.timeout
-        } else {
-          console.log('Please try again, allowing more time')
-          process.exit(1)
-        }
-      }
-    }
-  }
-}
-
-const retryScanPrompt = async () => {
-  const rl = readLine.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  })
-
-  return new Promise((resolve, reject) => {
-    requestUtils.timeOutError(30000, reject)
-
-    rl.question(
-      '🔁 Do you want to continue waiting on Scan? [Y/N]\n',
-      async input => {
-        if (input.toLowerCase() === 'yes' || input.toLowerCase() === 'y') {
-          console.log('Continuing wait for Scan')
-          rl.close()
-          resolve({ timeout: 300 })
-        } else if (
-          input.toLowerCase() === 'no' ||
-          input.toLowerCase() === 'n'
-        ) {
-          rl.close()
-          console.log('Contrast Scan Retry Cancelled: Exiting')
-          resolve(process.exit(1))
-        } else {
-          rl.close()
-          console.log('Invalid Input: Exiting')
-          resolve(process.exit(1))
-        }
-      }
-    )
-  }).catch(e => {
-    throw e
-  })
-}
-
-const returnScanResultsInstances = async (config, scanId) => {
-  const client = commonApi.getHttpClient(config)
-  let result
-  try {
-    result = await client.getScanResultsInstances(config, scanId)
-    if (JSON.stringify(result.statusCode) == 200) {
-      return { body: result.body, statusCode: result.statusCode }
-    }
-
-    if (JSON.stringify(result.statusCode) == 503) {
-      return { statusCode: result.statusCode }
-    }
-  } catch (e) {
-    if (config.debug) {
-      console.log(e.message.toString())
-    }
-  }
-}
-
-module.exports = {
-  getScanId: getScanId,
-  returnScanResults: returnScanResults,
-  pollScanResults: pollScanResults,
-  returnScanResultsInstances: returnScanResultsInstances,
-  retryScanPrompt
-}