@contrast/contrast 2.0.2-beta.1 → 2.0.2-beta.10

package/src/lambda/lambdaUtils.ts

@@ -1,111 +0,0 @@
-import logSymbols from 'log-symbols'
-import chalk from 'chalk'
-import i18n from 'i18n'
-import {
-  FunctionConfiguration,
-  ListFunctionsCommand
-} from '@aws-sdk/client-lambda'
-import { groupBy, sortBy } from 'lodash'
-import { getLambdaClient } from './aws'
-import ora from '../utils/oraWrapper'
-import { LambdaOptions } from './lambda'
-import { log, getReadableFileSize } from './logUtils'
-
-type RuntimeLanguage = 'java' | 'python' | 'node' | 'dotnet'
-
-type FilterLambdas = {
-  runtimes: RuntimeLanguage[]
-  filterText?: string
-}
-
-/**
- *
- * @param fucntions all user lambdas
- * @param options filter values: runtime / free text
- * @returns
- */
-const printAvailableLambdas = (
-  fucntions: FunctionConfiguration[] = [],
-  options: FilterLambdas
-) => {
-  const { runtimes, filterText = '' } = options
-  const searchValue = filterText?.trim().toLowerCase()
-
-  const filteredFunctions = fucntions
-    .filter(f => runtimes.some(r => f.Runtime?.includes(r)))
-    .filter(f => f.FunctionName?.toLowerCase().includes(searchValue))
-  log(
-    i18n.__('availableForScan', {
-      icon: logSymbols.success,
-      count: `${filteredFunctions.length}`
-    })
-  )
-  const groupByRuntime = groupBy(filteredFunctions, 'Runtime')
-
-  Object.entries(groupByRuntime).forEach(([runtime, arr]) => {
-    const sorted = sortBy(arr, 'FunctionName')
-    const count = `${arr.filter(a => a.Runtime === runtime).length}`
-
-    log(chalk.gray(i18n.__('runtimeCount', { runtime, count })))
-    sorted.forEach(f => {
-      const size = f.CodeSize ? getReadableFileSize(f.CodeSize) : ''
-      log(`${f.FunctionName} ${chalk.gray(`(${size})`)}`)
-    })
-  })
-}
-
-/**
- *
- * @param lambdaOptions to create lambdaClient
- * @returns list of all user lambdas that availbale to scan
- */
-const getAllLambdas = async (lambdaOptions: LambdaOptions) => {
-  const functions: FunctionConfiguration[] = []
-  const spinner = ora.returnOra(i18n.__('loadingFunctionList'))
-
-  try {
-    const client = getLambdaClient(lambdaOptions)
-    const command = new ListFunctionsCommand({})
-
-    ora.startSpinner(spinner)
-
-    const data = await client.send(command)
-    const { Functions } = data
-    let { NextMarker } = data
-
-    if (!Functions?.length) {
-      ora.failSpinner(spinner, i18n.__('noFunctionsFound'))
-      return
-    }
-
-    functions.push(...Functions)
-    spinner.text = i18n.__('functionsFound', { count: `${functions.length}` })
-
-    // pagination on functions
-    while (NextMarker) {
-      command.input.Marker = NextMarker
-      const chank = await client.send(command)
-
-      if (chank.Functions?.length) {
-        functions.push(...chank.Functions)
-        spinner.text = i18n.__('functionsFound', {
-          count: `${functions.length}`
-        })
-      }
-
-      NextMarker = chank.NextMarker
-    }
-
-    ora.succeedSpinner(
-      spinner,
-      i18n.__('functionsFound', { count: `${functions.length}` })
-    )
-  } catch (error) {
-    ora.failSpinner(spinner, i18n.__('failedToLoadFunctions'))
-    throw error
-  }
-
-  return functions
-}
-
-export { getAllLambdas, printAvailableLambdas }

package/src/lambda/logUtils.ts

@@ -1,64 +0,0 @@
-import chalk from 'chalk'
-import util from 'util'
-
-interface logStyles {
-  bold?: boolean
-  italic?: boolean
-  underline?: boolean
-  strikethrough?: boolean
-}
-
-const log = (message: string | number, styles?: logStyles) => {
-  let chalkFunction = chalk.reset
-
-  if (styles?.bold) {
-    chalkFunction = chalk.bold
-  } else if (styles?.italic) {
-    chalkFunction = chalk.italic
-  } else if (styles?.underline) {
-    chalkFunction = chalk.underline
-  } else if (styles?.strikethrough) {
-    chalkFunction = chalk.strikethrough
-  }
-
-  console.log(styles ? chalkFunction(message) : message)
-}
-
-/**
- *
- * @param obj any json object or string
- * @param depth determines how levels it will recurse to show the json
- */
-const prettyPrintJson = (obj: string | any, depth: number | null = null) => {
-  if (!obj) {
-    return
-  }
-
-  let objToPrint = obj
-
-  if (typeof obj === 'string') {
-    objToPrint = JSON.parse(obj)
-  }
-
-  console.log(util.inspect(objToPrint, { colors: true, depth }))
-}
-
-/**
- *
- * @param fileSizeInBytes
- *
- * @returns human readable format
- */
-const getReadableFileSize = (fileSizeInBytes: number) => {
-  let i = -1
-  const byteUnits = [' kB', ' MB', ' GB', ' TB', 'PB', 'EB', 'ZB', 'YB']
-
-  do {
-    fileSizeInBytes = fileSizeInBytes / 1024
-    i++
-  } while (fileSizeInBytes > 1024)
-
-  return Math.max(fileSizeInBytes, 0.1).toFixed(1) + byteUnits[i]
-}
-
-export { log, prettyPrintJson, getReadableFileSize }

package/src/lambda/scanDetailCompletion.ts

@@ -1,78 +0,0 @@
-import i18n from 'i18n'
-import { sleep } from '../utils/requestUtils'
-import { getHttpClient } from '../utils/commonApi'
-import { ApiParams } from './lambda'
-import HTTPClient from '../common/HTTPClient'
-import ora from '../utils/oraWrapper'
-import { CliError } from './cliError'
-import { ERRORS } from './constants'
-import { ContrastConf } from '../utils/getConfig'
-
-const MS_IN_MINUTE = 1000 * 60
-
-const getScanResources = async (
-  config: ContrastConf,
-  params: ApiParams,
-  scanId: string,
-  httpClient: HTTPClient
-) => {
-  const res = await httpClient.getScanResources(config, params, scanId)
-  const { statusCode, body } = res
-
-  if (statusCode === 200) {
-    return res
-  }
-
-  const { errorCode } = body || {}
-  throw new CliError(ERRORS.FAILED_TO_GET_SCAN, { statusCode, errorCode })
-}
-
-const pollScanUntilCompletion = async (
-  config: any,
-  timeoutInMinutes: number,
-  params: ApiParams,
-  scanId: string
-) => {
-  const client = getHttpClient(config)
-
-  const activeStatuses = ['PENDING', 'SCANNING', 'QUEUED']
-  const maxEndTime = new Date().getTime() + timeoutInMinutes * MS_IN_MINUTE
-  const startScanSpinner = ora.returnOra(i18n.__('scanStarted'))
-  ora.startSpinner(startScanSpinner)
-
-  await sleep(5000) // wait 5 sec before first polling
-
-  let complete = false
-  while (!complete) {
-    try {
-      const result = await exports.getScanResources(
-        config,
-        params,
-        scanId,
-        client
-      )
-      const { resources: scans } = result.body.data
-      const staticScans = scans?.filter((s: any) => s.scanType === 2)
-      complete = staticScans.some((s: any) => !activeStatuses.includes(s.state))
-
-      if (complete) {
-        ora.succeedSpinner(startScanSpinner, 'Scan Finished')
-        return scans
-      }
-
-      await sleep(2 * 1000)
-    } catch (error) {
-      ora.failSpinner(startScanSpinner, i18n.__('scanFailed'))
-      throw error
-    }
-
-    if (Date.now() >= maxEndTime) {
-      ora.failSpinner(startScanSpinner, i18n.__('scanTimedOut'))
-      throw new CliError(ERRORS.FAILED_TO_GET_SCAN, {
-        errorCode: 'waitingTimedOut'
-      })
-    }
-  }
-}
-
-export { pollScanUntilCompletion, getScanResources }

package/src/lambda/scanRequest.ts

@@ -1,169 +0,0 @@
-import i18n from 'i18n'
-import logSymbols from 'log-symbols'
-import chalk from 'chalk'
-import { parseARN } from './arn'
-import {
-  getLambdaClient,
-  getLambdaFunctionConfiguration,
-  getLambdaPolicies,
-  getLayersLinks
-} from './aws'
-import { toLowerKeys } from './utils'
-import { getHttpClient } from '../utils/commonApi'
-import { ApiParams, LambdaOptions } from './lambda'
-import { log, prettyPrintJson } from './logUtils'
-import { CliError } from './cliError'
-import { ERRORS } from './constants'
-import { sleep } from '../utils/requestUtils'
-
-const MAX_RETRIES = 2
-
-const sendScanPostRequest: (
-  config: any,
-  params: ApiParams,
-  functionsEvent: unknown,
-  showProgress?: boolean,
-  retryNumber?: number
-) => any = async (
-  config,
-  params,
-  functionsEvent,
-  showProgress = false,
-  retryNumber = 0
-) => {
-  const client = getHttpClient(config)
-
-  if (showProgress) {
-    log(i18n.__('sendingScanRequest', { icon: logSymbols.success }))
-  }
-
-  const res = await client.postFunctionScan(config, params, functionsEvent)
-  const { statusCode, body } = res
-
-  if (statusCode === 201) {
-    if (showProgress) {
-      log(i18n.__('scanRequestedSuccessfully', { icon: logSymbols.success }))
-    }
-
-    return body?.data?.scanId
-  }
-
-  let { errorCode } = body?.data || {}
-  const { data } = body?.data || {}
-
-  let description = ''
-  switch (errorCode) {
-    case 'not_supported_runtime':
-      description = i18n.__(errorCode, {
-        runtime: data?.runtime,
-        supportedRuntimes: data?.supportedRuntimes.sort().join(' | ')
-      })
-      errorCode = false
-      break
-    case 'not_supported_lambda':
-      description = i18n.__(errorCode)
-      errorCode = false
-      break
-    default:
-      if (retryNumber < MAX_RETRIES) {
-        await sleep(3 * 1000)
-        return sendScanPostRequest(
-          config,
-          params,
-          functionsEvent,
-          showProgress,
-          retryNumber + 1
-        )
-      }
-  }
-
-  throw new CliError(ERRORS.FAILED_TO_START_SCAN, {
-    statusCode,
-    errorCode,
-    data,
-    description
-  })
-}
-
-const createFunctionEvent = (
-  lambdaConfig: any,
-  layersLinks: any,
-  lambdaPolicies: any
-) => {
-  delete lambdaConfig.$metadata
-
-  const functionEvent = toLowerKeys(lambdaConfig.Configuration)
-  functionEvent['code'] = lambdaConfig.Code
-  functionEvent['rolePolicies'] = lambdaPolicies
-
-  if (layersLinks) {
-    functionEvent['layers'] = layersLinks
-  }
-
-  return { function: functionEvent }
-}
-
-const requestScanFunctionPost = async (
-  config: any,
-  lambdaOptions: LambdaOptions
-) => {
-  const { verbose, jsonOutput, functionName } = lambdaOptions
-  const lambdaClient = getLambdaClient(lambdaOptions)
-
-  if (!jsonOutput) {
-    log(
-      i18n.__('fetchingConfiguration', {
-        icon: logSymbols.success,
-        functionName: chalk.bold(functionName)
-      })
-    )
-  }
-
-  const lambdaConfig = await getLambdaFunctionConfiguration(
-    lambdaClient,
-    lambdaOptions
-  )
-  if (!lambdaConfig?.Configuration) {
-    throw new CliError(ERRORS.FAILED_TO_START_SCAN, {
-      errorCode: 'missingLambdaConfig'
-    })
-  }
-  const { Configuration } = lambdaConfig
-  const layersLinks = await getLayersLinks(lambdaClient, Configuration)
-  const lambdaPolicies = await getLambdaPolicies(Configuration, lambdaOptions)
-
-  const functionEvent = createFunctionEvent(
-    lambdaConfig,
-    layersLinks,
-    lambdaPolicies
-  )
-  const { FunctionArn: functionArn } = Configuration
-  if (!functionArn) {
-    throw new CliError(ERRORS.FAILED_TO_START_SCAN, {
-      errorCode: 'missingLambdaArn'
-    })
-  }
-
-  const parsedARN = parseARN(functionArn)
-  const params: ApiParams = {
-    organizationId: config.organizationId,
-    provider: 'aws',
-    accountId: parsedARN.accountId
-  }
-
-  if (verbose) {
-    log(i18n.__('fetchedConfiguration', { icon: logSymbols.success }))
-    prettyPrintJson(functionEvent)
-  }
-
-  const scanId = await sendScanPostRequest(
-    config,
-    params,
-    functionEvent,
-    !jsonOutput
-  )
-
-  return { scanId, params, functionArn }
-}
-
-export { sendScanPostRequest, requestScanFunctionPost, createFunctionEvent }

package/src/lambda/scanResults.ts

@@ -1,29 +0,0 @@
-import { getHttpClient } from '../utils/commonApi'
-import { CliError } from './cliError'
-import { ERRORS } from './constants'
-import { ApiParams } from './lambda'
-
-const getScanResults = async (
-  config: any,
-  params: ApiParams,
-  scanId: string,
-  functionArn: string
-) => {
-  const client = getHttpClient(config)
-
-  const { statusCode, body } = await client.getFunctionScanResults(
-    config,
-    params,
-    scanId,
-    functionArn
-  )
-
-  if (statusCode === 200) {
-    return body
-  }
-
-  const { errorCode } = body || {}
-  throw new CliError(ERRORS.FAILED_TO_GET_RESULTS, { statusCode, errorCode })
-}
-
-export { getScanResults }

package/src/lambda/types.ts

@@ -1,36 +0,0 @@
-export enum StatusType {
-  FAILED = 'failed',
-  SUCCESS = 'success'
-}
-
-export enum EventType {
-  START = 'start_command_session',
-  END = 'end_command_session'
-}
-
-export type LambdaOptions = {
-  functionName?: string
-  listFunctions?: boolean
-  region?: string
-  endpointUrl?: string
-  profile?: string
-  help?: boolean
-  verbose?: boolean
-  jsonOutput?: boolean
-  _unknown?: string[]
-}
-
-type ScanFunctionData = {
-  functionArn: string
-  scanId: string
-}
-
-export type AnalyticsOption = {
-  sessionId: string
-  eventType: EventType
-  packageVersion: string
-  arguments?: LambdaOptions
-  scanFunctionData?: ScanFunctionData
-  status?: StatusType
-  errorMsg?: string
-}

package/src/lambda/utils.ts

@@ -1,188 +0,0 @@
-import chalk from 'chalk'
-import { groupBy, sortBy, capitalize, minBy } from 'lodash'
-import i18n from 'i18n'
-import { log } from './logUtils'
-
-// fix for using `plural`
-// https://github.com/mashpie/i18n-node/issues/429
-i18n.setLocale('en')
-
-class PrintVulnerability {
-  index: number
-  vulnerability: any
-  group?: any[]
-  title: string
-  severity: string
-  remediation: string
-  description: string
-  recommendation: string
-  whatHappened: string
-
-  constructor(index: number, vulnerability: any, group?: any[]) {
-    const { severityText, title, description, remediation, categoryText } =
-      vulnerability
-
-    this.group = group
-    this.vulnerability = vulnerability
-    this.index = index
-    this.title = title
-    this.severity = capitalize(severityText)
-    this.description = underlineLinks(description)
-    this.remediation = remediation?.description
-    this.recommendation = ''
-    this.whatHappened = ''
-
-    if (categoryText === 'PERMISSIONS') {
-      this.formatPermissions()
-    } else if (categoryText === 'DEPENDENCIES') {
-      this.formatDependencies()
-    }
-  }
-
-  formatPermissions() {
-    const { leastPrivilege, comment } = this.vulnerability.evidence
-    const violatingPolicies = leastPrivilege?.violatingPolicies || []
-
-    const filteredPolicies = violatingPolicies
-      .filter((vp: any) => vp?.suggestedPolicy?.suggestedPolicyCode?.length)
-      .map((vp: any) => vp?.suggestedPolicy)
-
-    const shouldNumerate = filteredPolicies.length > 1
-    filteredPolicies.forEach((policies: any, i: number) => {
-      const { suggestedPolicyCode, description } = policies
-
-      suggestedPolicyCode.forEach((policy: any) => {
-        const { snippet, title } = policy
-        this.recommendation += shouldNumerate
-          ? ` ${i + 1}. ${description}\n`
-          : `${description}\n`
-
-        if (title !== 'DELETE POLICY') {
-          this.recommendation += `${snippet}\n`
-        }
-      })
-    })
-
-    if (comment?.length) {
-      const splitComment = (comment: string) => {
-        const [policy, description] = comment.split(':').map(c => c.trim())
-        return { policy, description }
-      }
-      const groupByPolicy = groupBy(comment, c => splitComment(c).policy)
-
-      Object.entries(groupByPolicy).forEach(([policy, commentArr]) => {
-        const comments = commentArr
-          .map(splitComment)
-          .map(({ description }) => ` - ${description}`)
-          .join('\n')
-        this.whatHappened += i18n.__('whatHappenedItem', { policy, comments })
-      })
-    }
-  }
-
-  formatDependencies() {
-    if (!this.group?.length) {
-      this.recommendation = this.vulnerability?.remediation?.description
-      return
-    }
-
-    const maxSeverity = minBy(this.group, 'severity')
-    this.title = i18n.__('vulnerableDependency')
-    this.severity = capitalize(maxSeverity.severityText)
-    this.recommendation = maxSeverity.remediation?.description
-
-    const library = groupByDependency({ title: this.vulnerability.title })
-    const [packageName, version] = library.split(':')
-    const allCves = this.group.map(groupByCVE)
-
-    this.description = i18n.__mf('vulnerableDependencyDescriptions', {
-      NUM: this.group.length,
-      packageName,
-      version,
-      cves: allCves.join(' | ')
-    })
-  }
-
-  print() {
-    log(`${this.index}.`)
-    // prettier-ignore
-    log(`${chalk.bold(this.severity)} | ${chalk.bold(this.title)} ${this.description}`)
-
-    if (this.whatHappened) {
-      log(`\n${chalk.bold(i18n.__('whatHappenedTitle'))}\n${this.whatHappened}`)
-    }
-
-    if (this.recommendation) {
-      log(`${chalk.bold(i18n.__('recommendation'))}\n${this.recommendation}`)
-    }
-
-    log('')
-  }
-}
-
-const groupByCVE = ({ title }: any) =>
-  title.substring(0, title.indexOf('[') - 1)
-
-const groupByDependency = ({ title }: any) =>
-  title.substring(title.indexOf('[') + 1, title.indexOf(']'))
-
-const printResults = (results: any[]) => {
-  //filter out any vulnerabs which is not least privilege or dependencies- cli does not handle other vulnerabs yet
-  const vulnerabs = results.filter(r => r.category === 1 || r.category === 4)
-  const sortBySeverity = sortBy(vulnerabs, ['severity', 'title'])
-  const notDependencies = sortBySeverity.filter(r => r.category !== 1)
-  const dependencies = sortBySeverity.filter(r => r.category === 1)
-  const dependenciesByLibrary = groupBy(dependencies, groupByDependency)
-
-  log('')
-
-  notDependencies.forEach((vulnerability: any, index: number) => {
-    const printVulnerab = new PrintVulnerability(index + 1, vulnerability)
-    printVulnerab.print()
-  })
-  const prevIndex = notDependencies.length + 1
-  Object.entries(dependenciesByLibrary).forEach(([, group], i) => {
-    const printVulnerab = new PrintVulnerability(prevIndex + i, group[0], group)
-    printVulnerab.print()
-  })
-
-  const dependenciesCount = Object.keys(dependenciesByLibrary).length
-  const resultCount = notDependencies.length + dependenciesCount
-  log(i18n.__n('foundVulnerabilities', resultCount), { bold: true })
-
-  const counters = getNotDependenciesCounters(notDependencies)
-  if (dependenciesCount) {
-    counters.push(i18n.__n('dependenciesCount', dependenciesCount))
-  }
-  log(counters.join(' | '), { bold: true })
-}
-
-const getNotDependenciesCounters = (notDependencies: any[]) => {
-  const groupByType = groupBy(notDependencies, ['categoryText'])
-  return Object.values(groupByType).map(
-    group => `${group.length} ${capitalize(group[0].categoryText)}`
-  )
-}
-
-const underlineLinks = (text: string) => {
-  if (!text) {
-    return text
-  }
-  const urlRegex = /(https?:\/\/[^\s]+)/g
-  return text.replace(urlRegex, chalk.underline('$1'))
-}
-
-function toLowerKeys(obj: Record<string, unknown>) {
-  return Object.keys(obj).reduce((accumulator, key) => {
-    const new_key = `${key[0].toLowerCase()}${key.slice(1)}`
-    accumulator[new_key] = obj[key]
-    return accumulator
-  }, {} as Record<string, unknown>)
-}
-
-export { toLowerKeys, printResults }
-export const exportedForTesting = {
-  underlineLinks,
-  printResults,
-  PrintVulnerability
-}