@contrast/contrast 2.0.2-beta.1 → 2.0.2-beta.11

package/src/lambda/aws.ts

@@ -1,248 +0,0 @@
-import i18n from 'i18n'
-import {
-  Lambda,
-  GetFunctionCommand,
-  GetLayerVersionByArnCommand,
-  FunctionConfiguration,
-  ResourceNotFoundException,
-  LambdaServiceException
-} from '@aws-sdk/client-lambda'
-import {
-  GetRolePolicyCommand,
-  IAMClient,
-  paginateListRolePolicies,
-  paginateListAttachedRolePolicies,
-  GetPolicyCommand,
-  GetPolicyVersionCommand
-} from '@aws-sdk/client-iam'
-import { fromIni } from '@aws-sdk/credential-provider-ini'
-import { RegionInputConfig } from '@aws-sdk/config-resolver/dist-types/regionConfig/resolveRegionConfig'
-import { EndpointsInputConfig } from '@aws-sdk/config-resolver/dist-types/endpointsConfig/resolveEndpointsConfig'
-import { AwsAuthInputConfig } from '@aws-sdk/middleware-signing/dist-types/configurations'
-import { CliError } from './cliError'
-import { LambdaOptions } from './lambda'
-import { ERRORS } from './constants'
-
-type AWSClientConfig = RegionInputConfig &
-  EndpointsInputConfig &
-  AwsAuthInputConfig
-
-const getAwsClientOptions = ({
-  region,
-  endpointUrl,
-  profile
-}: LambdaOptions): AWSClientConfig => {
-  const credentials = profile ? fromIni({ profile }) : undefined
-  return {
-    region: region || process.env.AWS_DEFAULT_REGION,
-    endpoint: endpointUrl,
-    credentials
-  }
-}
-
-const getLambdaClient = (lambdaOptions: LambdaOptions) => {
-  try {
-    const clientOptions = getAwsClientOptions(lambdaOptions)
-    return new Lambda(clientOptions)
-  } catch (error) {
-    throw new CliError(ERRORS.AWS_ERROR, {
-      description: (error as Error).message
-    })
-  }
-}
-
-const getIAMClient = (lambdaOptions: LambdaOptions) => {
-  const clientOptions = getAwsClientOptions(lambdaOptions)
-  return new IAMClient(clientOptions)
-}
-
-const getLambdaFunctionConfiguration = async (
-  client: Lambda,
-  lambdaOptions: LambdaOptions
-) => {
-  const { functionName: FunctionName } = lambdaOptions
-  const getFunctionCommand = new GetFunctionCommand({ FunctionName })
-  try {
-    return await client.send(getFunctionCommand)
-  } catch (error) {
-    throwAwsError(error)
-  }
-}
-
-const getLayersLinks = async (
-  client: Lambda,
-  functionConfiguration: FunctionConfiguration
-) => {
-  const { Layers: layers = [] } = functionConfiguration
-  const resultPromises = layers.map(async layerDict => {
-    try {
-      const layerArn = layerDict.Arn
-      const getLayerVersionByArnCommand = new GetLayerVersionByArnCommand({
-        Arn: layerArn
-      })
-      const layer = await client.send(getLayerVersionByArnCommand)
-      return {
-        Arn: layerArn,
-        Location: layer.Content?.Location
-      }
-    } catch (e) {
-      if (e instanceof ResourceNotFoundException) {
-        e.message = i18n.__('layerNotFound', {
-          layerArn: layerDict.Arn || 'unknown_arn'
-        })
-        throw e
-      }
-      throw e
-    }
-  })
-  const results = await Promise.allSettled(resultPromises)
-  const validLayers = results.filter(layerResult => {
-    if (layerResult.status === 'rejected') {
-      console.warn(layerResult.reason.message)
-      return false
-    }
-    return true
-  })
-  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-  // @ts-ignore: value is not recognized
-  return validLayers.map(layer => layer.value)
-}
-
-const getLambdaPolicies = async (
-  functionConfiguration: FunctionConfiguration,
-  lambdaOptions: LambdaOptions
-) => {
-  const { Role: roleArn } = functionConfiguration
-  const roleSplitList = roleArn?.split('/')
-
-  if (roleSplitList) {
-    const roleName = roleSplitList[roleSplitList.length - 1]
-    const client = exports.getIAMClient(lambdaOptions)
-    const rolePolicies = await getRolePolicies(roleName, client)
-    const attachedPolicies = await getAttachedPolicies(roleName, client)
-    return [...rolePolicies, ...attachedPolicies]
-  }
-}
-
-const getRolePolicyNames = async (roleName: string, client: IAMClient) => {
-  const listRolePolicyNames = []
-
-  try {
-    for await (const page of paginateListRolePolicies(
-      { client },
-      { RoleName: roleName }
-    )) {
-      if (page.PolicyNames) {
-        listRolePolicyNames.push(...page.PolicyNames)
-      }
-    }
-  } catch (error) {
-    throwAwsError(error)
-  }
-
-  return listRolePolicyNames
-}
-
-const getAttachedPolicyNames = async (roleName: string, client: IAMClient) => {
-  const listAttachedPolicies = []
-  for await (const page of paginateListAttachedRolePolicies(
-    { client },
-    { RoleName: roleName }
-  )) {
-    if (page.AttachedPolicies) {
-      listAttachedPolicies.push(...page.AttachedPolicies)
-    }
-  }
-  return listAttachedPolicies
-}
-
-const getRolePolicies = async (roleName: string, client: IAMClient) => {
-  const listRolePolicyNames = await exports.getRolePolicyNames(roleName, client)
-
-  if (listRolePolicyNames) {
-    const rolePoliciesPromises = listRolePolicyNames.map(
-      async (policyName: any) => {
-        const getRolePolicyCommand = new GetRolePolicyCommand({
-          PolicyName: policyName,
-          RoleName: roleName
-        })
-
-        const rolePolicy = await client.send(getRolePolicyCommand)
-        const policyDoc = JSON.parse(
-          decodeURIComponent(rolePolicy?.PolicyDocument || '{}')
-        )
-        policyDoc.PolicyName = policyName
-        return policyDoc
-      }
-    )
-
-    const rolePolicies = await Promise.all(rolePoliciesPromises)
-    return rolePolicies
-  }
-
-  return []
-}
-
-const getAttachedPolicies = async (roleName: string, client: IAMClient) => {
-  const listAttachedPolicies = await exports.getAttachedPolicyNames(
-    roleName,
-    client
-  )
-  const attachedPoliciesPromises = listAttachedPolicies.map(
-    async (policyDict: { PolicyArn: any; PolicyName: any }) => {
-      const { PolicyArn, PolicyName } = policyDict
-      const getPolicyCommand = new GetPolicyCommand({ PolicyArn })
-      const policy = await client.send(getPolicyCommand)
-
-      if (policy.Policy) {
-        const getPolicyVersionCommand = new GetPolicyVersionCommand({
-          PolicyArn: policy.Policy.Arn,
-          VersionId: policy.Policy.DefaultVersionId
-        })
-        const policyVersion = await client.send(getPolicyVersionCommand)
-        const policyDoc = JSON.parse(
-          decodeURIComponent(policyVersion?.PolicyVersion?.Document || '{}')
-        )
-
-        policyDoc['PolicyName'] = PolicyName
-        policyDoc['PolicyArn'] = PolicyArn
-        return policyDoc
-      }
-    }
-  )
-
-  const attachedPolicies = await Promise.all(attachedPoliciesPromises)
-  return attachedPolicies
-}
-
-/**
- *
- * @param error any error
- * @returns throw AWS error in union format
- */
-const throwAwsError = (error: any) => {
-  const serviceError = error as LambdaServiceException
-
-  if (error instanceof Error && serviceError.$metadata) {
-    const { httpStatusCode } = serviceError.$metadata
-    const { message } = error
-
-    throw new CliError(ERRORS.AWS_ERROR, {
-      statusCode: httpStatusCode,
-      description: message
-    })
-  }
-
-  throw error
-}
-
-export {
-  getAttachedPolicyNames,
-  getRolePolicyNames,
-  getIAMClient,
-  getLambdaClient,
-  getLambdaFunctionConfiguration,
-  getLayersLinks,
-  getLambdaPolicies,
-  throwAwsError
-}

package/src/lambda/cliError.ts

@@ -1,72 +0,0 @@
-import i18n from 'i18n'
-import * as errorHandling from '../common/errorHandling'
-
-type ErrorDetails = {
-  statusCode?: number // API statusCode
-  errorCode?: string // internal errorCode
-  description?: string // free usage
-  data?: any //
-}
-
-class CliError extends Error {
-  statusCode?: number
-  errorCode?: string
-  description?: string
-  data?: any
-
-  statusCodeDescription?: string
-  errorCodeDescription?: string
-
-  constructor(headerMessage: string, details?: ErrorDetails) {
-    const message = i18n.__(headerMessage || '')
-    super(message)
-
-    const { statusCode, errorCode, data, description } = details || {}
-
-    this.statusCode = statusCode
-    this.errorCode = errorCode
-    this.data = data
-    this.description = description
-
-    if (errorCode) {
-      this.errorCodeDescription = i18n.__(errorCode || '')
-    }
-
-    if (statusCode) {
-      this.statusCodeDescription = this.getMessageByStatusCode(statusCode)
-    }
-  }
-
-  getErrorMessage() {
-    let finalDesc =
-      this.errorCodeDescription || this.statusCodeDescription || ''
-
-    if (this.description) {
-      finalDesc += finalDesc ? `\n${this.description}` : this.description
-    }
-    return errorHandling.getErrorMessage(this.message, finalDesc)
-  }
-
-  getMessageByStatusCode(statusCode: number) {
-    switch (statusCode) {
-      case 200:
-        return ''
-      case 400:
-        return i18n.__('badRequestErrorHeader')
-      case 401:
-        return i18n.__('unauthenticatedErrorHeader')
-      case 403:
-        return i18n.__('forbiddenRequestErrorHeader')
-      case 404:
-        return i18n.__('not_found_404')
-      case 423:
-        return i18n.__('resourceLockedErrorHeader')
-      case 500:
-        return i18n.__('internalServerErrorHeader')
-      default:
-        return i18n.__('something_went_wrong')
-    }
-  }
-}
-
-export { CliError }

package/src/lambda/constants.ts

@@ -1,11 +0,0 @@
-// TODO: don't forget to add translation in `src/constants/lambda.js` for each value
-
-const ERRORS = Object.freeze({
-  AWS_ERROR: 'awsError',
-  FAILED_TO_START_SCAN: 'failedToStartScan',
-  FAILED_TO_GET_SCAN: 'failedToGetScan',
-  FAILED_TO_GET_RESULTS: 'failedToGetResults',
-  VALIDATION_FAILED: 'validationFailed'
-})
-
-export { ERRORS }

package/src/lambda/help.ts

@@ -1,92 +0,0 @@
-import commandLineUsage from 'command-line-usage'
-import i18n from 'i18n'
-import { commonHelpLinks } from '../common/commonHelp'
-
-const lambdaUsageGuide = commandLineUsage([
-  {
-    header: i18n.__('constantsHeader')
-  },
-  {
-    header: i18n.__('lambdaHeader'),
-    content: [i18n.__('lambdaSummary')]
-  },
-  {
-    header: i18n.__('constantsPrerequisitesHeader'),
-    content: [
-      '{bold ' +
-        i18n.__('lambdaPrerequisitesContentLambdaLanguages') +
-        '}\n\n' +
-        '{bold ' +
-        i18n.__('lambdaPrerequisitesContentLambdaDescriptionTitle') +
-        '}' +
-        i18n.__('lambdaPrerequisitesContentLambdaDescription')
-    ]
-  },
-  {
-    header: i18n.__('constantsUsage'),
-    content: [i18n.__('lambdaUsage')]
-  },
-  {
-    header: i18n.__('constantsOptions'),
-    content: [
-      {
-        name: '{bold ' + i18n.__('lambdaFunctionNameOption') + '}',
-        summary: i18n.__('lambdaFunctionNameSummery')
-      },
-      {
-        name: '{bold ' + i18n.__('lambdaListFunctionsOption') + '}',
-        summary: i18n.__('lambdaListFunctionsSummery')
-      },
-      {
-        name: '{bold ' + i18n.__('lambdaEndpointOption') + '}',
-        summary:
-          '{bold ' +
-          i18n.__('constantsOptional') +
-          '}: ' +
-          i18n.__('lambdaEndpointSummery')
-      },
-      {
-        name: '{bold ' + i18n.__('lambdaRegionOption') + '}',
-        summary:
-          '{bold ' +
-          i18n.__('constantsOptional') +
-          '}: ' +
-          i18n.__('lambdaRegionSummery')
-      },
-      {
-        name: '{bold ' + i18n.__('lambdaProfileOption') + '}',
-        summary:
-          '{bold ' +
-          i18n.__('constantsOptional') +
-          '}: ' +
-          i18n.__('lambdaProfileSummery')
-      },
-      {
-        name: '{bold ' + i18n.__('lambdaJsonOption') + '}',
-        summary:
-          '{bold ' +
-          i18n.__('constantsOptional') +
-          '}: ' +
-          i18n.__('lambdaJsonSummery')
-      },
-      {
-        name: '{bold ' + i18n.__('lambdaVerboseOption') + '}',
-        summary:
-          '{bold ' +
-          i18n.__('constantsOptional') +
-          '}: ' +
-          i18n.__('lambdaVerbosSummery')
-      }
-    ]
-  },
-  {
-    content: [
-      { name: i18n.__('lambdaHelpOption'), summary: i18n.__('helpSummary') }
-    ]
-  },
-  commonHelpLinks()[0],
-  commonHelpLinks()[1],
-  commonHelpLinks()[2]
-])
-
-export { lambdaUsageGuide }

package/src/lambda/lambda.ts

@@ -1,230 +0,0 @@
-import commandLineArgs from 'command-line-args'
-import { performance } from 'perf_hooks'
-import { kebabCase } from 'lodash'
-import i18n from 'i18n'
-import { getAuth } from '../utils/paramsUtil/paramHandler'
-import { CliError } from './cliError'
-import { ERRORS } from './constants'
-import { lambdaUsageGuide } from './help'
-import { log } from './logUtils'
-import { pollScanUntilCompletion } from './scanDetailCompletion'
-import { requestScanFunctionPost } from './scanRequest'
-import { getScanResults } from './scanResults'
-import { printResults } from './utils'
-import { getAllLambdas, printAvailableLambdas } from './lambdaUtils'
-import { sleep } from '../utils/requestUtils'
-import ora from '../utils/oraWrapper'
-import { postAnalytics } from './analytics'
-import { LambdaOptions, AnalyticsOption, StatusType, EventType } from './types'
-import { APP_VERSION } from '../constants/constants'
-import { postRunMessage } from '../common/commonHelp'
-
-type ApiParams = {
-  organizationId: string
-  provider: 'aws'
-  accountId: string
-}
-
-const failedStates = [
-  'UNSUPPORTED',
-  'EXCLUDED',
-  'CANCELED',
-  'FAILED',
-  'DISMISSED'
-]
-
-const printHelpMessage = () => {
-  log(lambdaUsageGuide)
-}
-
-const getLambdaOptions = (argv: string[]) => {
-  try {
-    const lambdaDefinitions = [
-      { name: 'function-name', alias: 'f', type: String },
-      { name: 'list-functions', alias: 'l', type: Boolean },
-      { name: 'region', alias: 'r', type: String },
-      { name: 'endpoint-url', alias: 'e', type: String },
-      { name: 'profile', alias: 'p', type: String },
-      { name: 'help', alias: 'h', type: Boolean },
-      { name: 'verbose', alias: 'v', type: Boolean },
-      { name: 'json-output', alias: 'j', type: Boolean }
-    ]
-
-    const lambdaOptions: LambdaOptions = commandLineArgs(lambdaDefinitions, {
-      argv,
-      partial: true,
-      camelCase: true,
-      caseInsensitive: true
-    })
-
-    return lambdaOptions
-  } catch (error) {
-    throw new CliError(ERRORS.VALIDATION_FAILED, {
-      description: (error as Error).message
-    })
-  }
-}
-
-const processLambda = async (argv: string[]) => {
-  let errorMsg
-  let scanInfo: { functionArn: string; scanId: string } | undefined
-  const commandSessionId = Date.now().toString(36)
-  try {
-    const lambdaOptions = getLambdaOptions(argv)
-    const { help } = lambdaOptions
-    const startCommandAnalytics: AnalyticsOption = {
-      arguments: lambdaOptions,
-      sessionId: commandSessionId,
-      eventType: EventType.START,
-      packageVersion: APP_VERSION
-    }
-    postAnalytics(startCommandAnalytics).catch((error: Error) => {
-      /* ignore */
-    })
-    if (help) {
-      return handleLambdaHelp()
-    }
-
-    validateRequiredLambdaParams(lambdaOptions)
-
-    if (lambdaOptions.listFunctions) {
-      await getAvailableFunctions(lambdaOptions)
-    } else {
-      scanInfo = await actualProcessLambda(lambdaOptions)
-    }
-  } catch (error) {
-    if (error instanceof CliError) {
-      errorMsg = error.getErrorMessage()
-    } else if (error instanceof Error) {
-      errorMsg = error.message
-    }
-  } finally {
-    const endCommandAnalytics: AnalyticsOption = {
-      sessionId: commandSessionId,
-      eventType: EventType.END,
-      status: errorMsg ? StatusType.FAILED : StatusType.SUCCESS,
-      packageVersion: APP_VERSION
-    }
-    if (errorMsg) {
-      endCommandAnalytics.errorMsg = errorMsg
-      console.error(errorMsg)
-    }
-    if (scanInfo) {
-      endCommandAnalytics.scanFunctionData = scanInfo
-    }
-    await postAnalytics(endCommandAnalytics).catch((error: Error) => {
-      /* ignore */
-    })
-
-    postRunMessage('lambda')
-
-    if (errorMsg) {
-      process.exit(1)
-    }
-  }
-}
-
-const getAvailableFunctions = async (lambdaOptions: LambdaOptions) => {
-  const lambdas = await getAllLambdas(lambdaOptions)
-  printAvailableLambdas(lambdas, {
-    runtimes: ['python', 'java', 'node', 'dotnet']
-  })
-}
-
-const actualProcessLambda = async (lambdaOptions: LambdaOptions) => {
-  const auth = getAuth()
-  const startTime = performance.now()
-  const { jsonOutput } = lambdaOptions
-  const { scanId, params, functionArn } = await requestScanFunctionPost(
-    auth,
-    lambdaOptions
-  )
-  const scans = await pollScanUntilCompletion(auth, 10, params, scanId)
-  const failedScan = scans
-    ?.filter((s: any) => s.scanType === 2)
-    .find((s: any) => failedStates.includes(s.state))
-
-  if (failedScan) {
-    throw new CliError(ERRORS.FAILED_TO_GET_SCAN, {
-      statusCode: 200,
-      errorCode: failedScan.state,
-      description: failedScan.stateReasonText
-    })
-  }
-
-  // Wait to make sure we will have all the results
-  const startGetherResultsSpinner = ora.returnOra(i18n.__('gatherResults'))
-  ora.startSpinner(startGetherResultsSpinner)
-  await sleep(15 * 1000)
-  ora.succeedSpinner(startGetherResultsSpinner, 'Done gathering results')
-
-  const resultsResponse = await getScanResults(
-    auth,
-    params,
-    scanId,
-    functionArn
-  )
-
-  if (jsonOutput) {
-    console.log(JSON.stringify(resultsResponse?.data?.results, null, 2))
-    return
-  }
-
-  const results = resultsResponse?.data?.results
-  if (!results) {
-    throw new CliError(ERRORS.FAILED_TO_GET_RESULTS, {
-      errorCode: 'missingResults'
-    })
-  }
-
-  if (!results.length) {
-    log('👏 No vulnerabilities found')
-  }
-
-  const endTime = performance.now()
-  const scanDurationMs = endTime - startTime
-
-  log(`----- Scan completed ${(scanDurationMs / 1000).toFixed(2)}s -----`)
-
-  if (results?.length) {
-    printResults(results)
-  }
-
-  return { functionArn, scanId }
-}
-
-const validateRequiredLambdaParams = (options: LambdaOptions) => {
-  if (options._unknown?.length) {
-    throw new CliError(ERRORS.VALIDATION_FAILED, {
-      description: i18n.__('notSupportedFlags', {
-        flags: options._unknown.join('\n')
-      })
-    })
-  }
-
-  if (!options?.functionName && !options?.listFunctions) {
-    throw new CliError(ERRORS.VALIDATION_FAILED, {
-      errorCode: 'missingFunctionName'
-    })
-  }
-
-  const flagsWithoutValues = Object.entries(options)
-    .filter(([, value]) => !value)
-    .map(([key]) => key)
-    .map(p => `--${kebabCase(p)}`)
-
-  if (flagsWithoutValues.length) {
-    throw new CliError(ERRORS.VALIDATION_FAILED, {
-      description: i18n.__('missingFlagArguments', {
-        flags: flagsWithoutValues.join('\n')
-      })
-    })
-  }
-}
-
-const handleLambdaHelp = () => {
-  printHelpMessage()
-  process.exit(0)
-}
-
-export { processLambda, LambdaOptions, ApiParams, getAvailableFunctions }