@contrast/contrast 2.0.2-beta.1 → 2.0.2-beta.11

package/src/audit/report/models/reportListModel.ts

@@ -1,49 +0,0 @@
-import { ReportSeverityModel } from './reportSeverityModel'
-import { ReportCVEModel } from './reportLibraryModel'
-import {
-  ScaReportRemediationAdviceModel,
-  ScaReportVulnerabilityModel
-} from '../../../scaAnalysis/common/models/ScaReportModel'
-
-export class ReportList {
-  reportOutputList: ReportModelStructure[]
-
-  constructor() {
-    this.reportOutputList = []
-  }
-}
-
-export class ReportModelStructure {
-  compositeKey: ReportCompositeKey
-  cveArray: ReportCVEModel[] | ScaReportVulnerabilityModel[]
-  remediationAdvice: ScaReportRemediationAdviceModel | null
-
-  constructor(
-    compositeKey: ReportCompositeKey,
-    cveArray: ReportCVEModel[] | ScaReportVulnerabilityModel[],
-    remediationAdvice: ScaReportRemediationAdviceModel | null
-  ) {
-    this.compositeKey = compositeKey
-    this.cveArray = cveArray
-    this.remediationAdvice = remediationAdvice
-  }
-}
-
-export class ReportCompositeKey {
-  libraryName!: string
-  libraryVersion!: string
-  highestSeverity!: ReportSeverityModel
-  numberOfSeverities!: number
-
-  constructor(
-    libraryName: string,
-    libraryVersion: string,
-    highestSeverity: ReportSeverityModel,
-    numberOfSeverities: number
-  ) {
-    this.libraryName = libraryName
-    this.libraryVersion = libraryVersion
-    this.highestSeverity = highestSeverity
-    this.numberOfSeverities = numberOfSeverities
-  }
-}

package/src/audit/report/models/reportOutputModel.ts

@@ -1,29 +0,0 @@
-export class ReportOutputModel {
-  header: ReportOutputHeaderModel
-  body: ReportOutputBodyModel
-
-  constructor(header: ReportOutputHeaderModel, body: ReportOutputBodyModel) {
-    this.header = header
-    this.body = body
-  }
-}
-
-export class ReportOutputHeaderModel {
-  vulnMessage: string
-  introducesMessage: string
-
-  constructor(vulnMessage: string, introducesMessage: string) {
-    this.vulnMessage = vulnMessage
-    this.introducesMessage = introducesMessage
-  }
-}
-
-export class ReportOutputBodyModel {
-  issueMessage: string[]
-  adviceMessage: string[]
-
-  constructor(issueMessage: string[], adviceMessage: string[]) {
-    this.issueMessage = issueMessage
-    this.adviceMessage = adviceMessage
-  }
-}

package/src/audit/report/models/reportSeverityModel.ts

@@ -1,18 +0,0 @@
-export class ReportSeverityModel {
-  severity: string
-  priority: number
-  colour: string
-  name: string
-
-  constructor(
-    severity: string,
-    priority: number,
-    colour: string,
-    name: string
-  ) {
-    this.severity = severity
-    this.priority = priority
-    this.colour = colour
-    this.name = name
-  }
-}

package/src/audit/report/models/severityCountModel.ts

@@ -1,22 +0,0 @@
-export class SeverityCountModel {
-  critical!: number
-  high!: number
-  medium!: number
-  low!: number
-  note!: number
-  total!: number
-
-  //needed as default to stop NaN when new object constructed
-  constructor() {
-    this.critical = 0
-    this.high = 0
-    this.medium = 0
-    this.low = 0
-    this.note = 0
-    this.total = 0
-  }
-
-  get getTotal(): number {
-    return this.critical + this.high + this.medium + this.low + this.note
-  }
-}

package/src/audit/report/reportingFeature.ts

@@ -1,110 +0,0 @@
-import {
-  getReport,
-  printNoVulnFoundMsg,
-  printVulnerabilityResponse
-} from './commonReportingFunctions'
-import {
-  convertGenericToTypedLibraryVulns,
-  severityCountAllLibraries
-} from './utils/reportUtils'
-import i18n from 'i18n'
-import chalk from 'chalk'
-import * as constants from '../../constants/constants'
-import { SeverityCountModel } from './models/severityCountModel'
-import * as common from '../../common/fail'
-import { auditSave } from '../save'
-
-export function convertKeysToStandardFormat(config: any, guidance: any) {
-  let convertedGuidance = guidance
-
-  switch (config.language) {
-    case constants.supportedLanguages.JAVA:
-    case constants.supportedLanguages.GO:
-    case constants.supportedLanguages.PHP:
-      break
-    case constants.supportedLanguages.NODE:
-    case constants.supportedLanguages.DOTNET:
-    case constants.supportedLanguages.PYTHON:
-    case constants.supportedLanguages.RUBY:
-      convertedGuidance = convertJSDotNetPython(guidance)
-      break
-  }
-  return convertedGuidance
-}
-
-export function convertJSDotNetPython(guidance: any) {
-  const returnObject = {}
-
-  Object.entries(guidance).forEach(([key, value]) => {
-    const splitKey = key.split('/')
-    if (splitKey.length === 2) {
-      // @ts-ignore
-      returnObject[splitKey[1]] = value
-    }
-  })
-  return returnObject
-}
-
-export function formatVulnerabilityOutput(
-  libraryVulnerabilityResponse: any,
-  id: string,
-  config: any,
-  remediationGuidance: any
-) {
-  const vulnerableLibraries = convertGenericToTypedLibraryVulns(
-    libraryVulnerabilityResponse
-  )
-
-  const guidance = convertKeysToStandardFormat(config, remediationGuidance)
-
-  const numberOfVulnerableLibraries = vulnerableLibraries.length
-
-  if (numberOfVulnerableLibraries === 0) {
-    printNoVulnFoundMsg()
-    return [false, 0, [new SeverityCountModel()]]
-  } else {
-    let numberOfCves = 0
-    vulnerableLibraries.forEach(lib => (numberOfCves += lib.cveArray.length))
-
-    const hasSomeVulnerabilitiesReported = printVulnerabilityResponse(
-      config,
-      vulnerableLibraries,
-      numberOfVulnerableLibraries,
-      numberOfCves,
-      guidance
-    )
-    let severityCount = new SeverityCountModel()
-    severityCount = severityCountAllLibraries(
-      vulnerableLibraries,
-      severityCount
-    )
-    severityCount.total = severityCount.getTotal
-    return [hasSomeVulnerabilitiesReported, numberOfCves, severityCount]
-  }
-}
-
-export async function vulnerabilityReportV2(config: any, reportId: string) {
-  console.log()
-  const reportResponse = await getReport(config, reportId)
-
-  if (reportResponse !== undefined) {
-    const output = formatVulnerabilityOutput(
-      reportResponse.vulnerabilities,
-      config.applicationId,
-      config,
-      reportResponse.remediationGuidance
-        ? reportResponse.remediationGuidance
-        : {}
-    )
-
-    if (config.save !== undefined) {
-      await auditSave(config)
-    } else {
-      console.log('\nUse contrast audit --save to generate an SBOM')
-    }
-
-    if (config.fail) {
-      common.processFail(config, output[2])
-    }
-  }
-}

package/src/audit/report/utils/reportUtils.ts

@@ -1,165 +0,0 @@
-import {
-  ReportCVEModel,
-  ReportLibraryModel
-} from '../models/reportLibraryModel'
-import { ReportSeverityModel } from '../models/reportSeverityModel'
-import languageAnalysisEngine, {
-  CRITICAL_COLOUR,
-  CRITICAL_PRIORITY,
-  HIGH_COLOUR,
-  HIGH_PRIORITY,
-  LOW_COLOUR,
-  LOW_PRIORITY,
-  MEDIUM_COLOUR,
-  MEDIUM_PRIORITY,
-  NOTE_COLOUR,
-  NOTE_PRIORITY
-} from '../../../constants/constants'
-import { orderBy } from 'lodash'
-import { SeverityCountModel } from '../models/severityCountModel'
-import { ReportModelStructure } from '../models/reportListModel'
-
-const {
-  supportedLanguages: { GO }
-} = languageAnalysisEngine
-
-export function findHighestSeverityCVE(cveArray: ReportCVEModel[]) {
-  const mappedToReportSeverityModels = cveArray.map(cve => findCVESeverity(cve))
-
-  //order and get first
-  return orderBy(mappedToReportSeverityModels, cve => cve?.priority)[0]
-}
-
-export function orderByHighestPriority(severityModels: ReportSeverityModel[]) {
-  return orderBy(severityModels, ['priority'], ['asc'])
-}
-
-export function findCVESeverity(cve: ReportCVEModel) {
-  const cveName = cve.name as string
-  if (cve.cvss3SeverityCode === 'CRITICAL' || cve.severityCode === 'CRITICAL') {
-    return new ReportSeverityModel(
-      'CRITICAL',
-      CRITICAL_PRIORITY,
-      CRITICAL_COLOUR,
-      cveName
-    )
-  } else if (cve.cvss3SeverityCode === 'HIGH' || cve.severityCode === 'HIGH') {
-    return new ReportSeverityModel('HIGH', HIGH_PRIORITY, HIGH_COLOUR, cveName)
-  } else if (
-    cve.cvss3SeverityCode === 'MEDIUM' ||
-    cve.severityCode === 'MEDIUM'
-  ) {
-    return new ReportSeverityModel(
-      'MEDIUM',
-      MEDIUM_PRIORITY,
-      MEDIUM_COLOUR,
-      cveName
-    )
-  } else if (cve.cvss3SeverityCode === 'LOW' || cve.severityCode === 'LOW') {
-    return new ReportSeverityModel('LOW', LOW_PRIORITY, LOW_COLOUR, cveName)
-  } else if (cve.cvss3SeverityCode === 'NOTE' || cve.severityCode === 'NOTE') {
-    return new ReportSeverityModel('NOTE', NOTE_PRIORITY, NOTE_COLOUR, cveName)
-  }
-}
-
-export function convertGenericToTypedLibraryVulns(libraries: any) {
-  return Object.entries(libraries).map(([name, cveArray]) => {
-    return new ReportLibraryModel(name, cveArray as ReportCVEModel[])
-  })
-}
-
-export function severityCountAllLibraries(
-  vulnerableLibraries: ReportLibraryModel[],
-  severityCount: SeverityCountModel
-) {
-  vulnerableLibraries.forEach(lib =>
-    severityCountAllCVEs(lib.cveArray, severityCount)
-  )
-  return severityCount
-}
-
-export function severityCountAllCVEs(
-  cveArray: ReportCVEModel[],
-  severityCount: SeverityCountModel
-) {
-  const severityCountInner = severityCount
-  cveArray.forEach(cve => severityCountSingleCVE(cve, severityCountInner))
-  return severityCountInner
-}
-
-export function severityCountSingleCVE(
-  cve: ReportCVEModel,
-  severityCount: SeverityCountModel
-) {
-  if (cve.cvss3SeverityCode === 'CRITICAL' || cve.severityCode === 'CRITICAL') {
-    severityCount.critical += 1
-  } else if (cve.cvss3SeverityCode === 'HIGH' || cve.severityCode === 'HIGH') {
-    severityCount.high += 1
-  } else if (
-    cve.cvss3SeverityCode === 'MEDIUM' ||
-    cve.severityCode === 'MEDIUM'
-  ) {
-    severityCount.medium += 1
-  } else if (cve.cvss3SeverityCode === 'LOW' || cve.severityCode === 'LOW') {
-    severityCount.low += 1
-  } else if (cve.cvss3SeverityCode === 'NOTE' || cve.severityCode === 'NOTE') {
-    severityCount.note += 1
-  }
-
-  return severityCount
-}
-
-export function findNameAndVersion(library: ReportLibraryModel, config: any) {
-  if (config.language.toUpperCase() === GO) {
-    const nameVersion = library.name.split('@')
-    const name = nameVersion[0]
-    const version = nameVersion[1]
-
-    return { name, version }
-  } else {
-    //spreads items from split into set so no duplicates appear
-    const uniqueSplitLibraryName = [...new Set(library.name.split('/'))]
-    const nameVersion = uniqueSplitLibraryName[1].split('@')
-
-    let parentLibrary
-    let name
-    if (
-      uniqueSplitLibraryName[0] !== 'null' &&
-      uniqueSplitLibraryName[0] !== '' &&
-      !uniqueSplitLibraryName[1].includes(uniqueSplitLibraryName[0])
-    ) {
-      //if the parent lib (element 0) is not null, not blank and not already part of the library name
-      //e.g. shared-ini-file-loader-1.0.0-rc.3 is very generic - converts to @aws-sdk/shared-ini-file-loader-1.0.0-rc.3
-      parentLibrary = uniqueSplitLibraryName[0]
-      name = `${parentLibrary}/${nameVersion[0]}`
-    } else {
-      name = nameVersion[0]
-    }
-
-    const version = nameVersion[1]
-
-    return { name, version }
-  }
-}
-
-export function countVulnerableLibrariesBySeverity(
-  reportModelStructure: ReportModelStructure[]
-) {
-  const severityCount = new SeverityCountModel()
-  reportModelStructure.forEach(vuln => {
-    const currentSeverity = vuln.compositeKey.highestSeverity.severity
-    if (currentSeverity === 'CRITICAL') {
-      severityCount.critical += 1
-    } else if (currentSeverity === 'HIGH') {
-      severityCount.high += 1
-    } else if (currentSeverity === 'MEDIUM') {
-      severityCount.medium += 1
-    } else if (currentSeverity === 'LOW') {
-      severityCount.low += 1
-    } else if (currentSeverity === 'NOTE') {
-      severityCount.note += 1
-    }
-  })
-
-  return severityCount
-}

package/src/audit/save.js

@@ -1,67 +0,0 @@
-const fs = require('fs')
-const i18n = require('i18n')
-const chalk = require('chalk')
-const save = require('../commands/audit/saveFile')
-const sbom = require('../sbom/generateSbom')
-const {
-  SBOM_CYCLONE_DX_FILE,
-  SBOM_SPDX_FILE
-} = require('../constants/constants')
-
-async function auditSave(config, reportId) {
-  let fileFormat
-  //validate the config to see if we can uppercase it
-  config.save = config.save ? config.save.toUpperCase() : config.save
-
-  switch (config.save) {
-    case null:
-    case SBOM_CYCLONE_DX_FILE:
-      fileFormat = SBOM_CYCLONE_DX_FILE
-      break
-    case SBOM_SPDX_FILE:
-      fileFormat = SBOM_SPDX_FILE
-      break
-    default:
-      break
-  }
-
-  if (fileFormat) {
-    if (config.legacy === false) {
-      const sbomResponse = await sbom.generateSCASbom(
-        config,
-        fileFormat,
-        reportId
-      )
-      if (sbomResponse) {
-        save.saveFile(config, fileFormat, sbomResponse)
-      }
-    } else {
-      const sbomResponse = await sbom.generateSbom(config, fileFormat)
-      if (sbomResponse) {
-        save.saveFile(config, fileFormat, sbomResponse)
-      }
-    }
-
-    let fileStart = config.legacy ? config.applicationId : config.projectId
-    if (fileStart === undefined) {
-      fileStart = 'my'
-    }
-
-    const filename = `${fileStart}-sbom-${fileFormat}.json`
-    if (fs.existsSync(filename)) {
-      console.log(i18n.__('auditSBOMSaveSuccess') + ` - ${filename}`)
-    } else {
-      console.log(
-        chalk.yellow.bold(
-          `\nUnable to save ${filename} Software Bill of Materials (SBOM)`
-        )
-      )
-    }
-  } else {
-    console.log(i18n.__('auditBadFiletypeSpecifiedForSave'))
-  }
-}
-
-module.exports = {
-  auditSave
-}