@contrast/contrast 2.0.2-beta.1 → 2.0.2-beta.11

package/src/scan/autoDetection.js

@@ -1,175 +0,0 @@
-const i18n = require('i18n')
-const fileFinder = require('./fileUtils')
-const {
-  supportedLanguages: { JAVA, GO, PYTHON, RUBY, JAVASCRIPT, NODE, PHP, DOTNET }
-} = require('../constants/constants')
-const autoDetectFingerprintInfo = async (filePath, depth, config) => {
-  let complexObj = await fileFinder.findAllFiles(filePath, depth)
-  let result = []
-  let count = 0
-  complexObj.forEach(i => {
-    count++
-    if (!i.includes('package.json')) {
-      result.push({
-        filePath: i,
-        id: count.toString(),
-        repositoryId: config.repositoryId,
-        projectGroupId: config.projectGroupId
-      })
-    }
-  })
-
-  return result
-}
-
-const detectPackageManager = async array => {
-  array.forEach(i => {
-    if (i.filePath.includes('pom.xml')) {
-      i['language'] = JAVA
-      i['packageManager'] = 'MAVEN'
-    }
-    if (i.filePath.includes('build.gradle.kts')) {
-      i['language'] = JAVA
-      i['packageManager'] = 'GRADLE'
-    }
-    if (i.filePath.includes('build.gradle')) {
-      i['language'] = JAVA
-      i['packageManager'] = 'GRADLE'
-    }
-    if (i.filePath.includes('package-lock.json')) {
-      i['language'] = JAVASCRIPT
-      i['packageManager'] = 'NPM'
-    }
-    if (i.filePath.includes('yarn.lock')) {
-      i['language'] = JAVASCRIPT
-      i['packageManager'] = 'YARN'
-    }
-    if (i.filePath.includes('Pipfile')) {
-      i['language'] = PYTHON
-      i['packageManager'] = 'PYPI'
-    }
-    if (i.filePath.includes('csproj')) {
-      i['language'] = DOTNET
-      i['packageManager'] = 'NUGET'
-    }
-    if (i.filePath.includes('Gemfile')) {
-      i['language'] = RUBY
-      i['packageManager'] = 'RUBYGEMS'
-    }
-    if (i.filePath.includes('go.mod')) {
-      i['language'] = GO
-      i['packageManager'] = 'PKG'
-    }
-  })
-  return array
-}
-
-const autoDetectFileAndLanguage = async configToUse => {
-  const entries = await fileFinder.findFile()
-
-  if (entries.length === 1) {
-    console.log(i18n.__('foundScanFile', entries[0]))
-
-    if (hasWhiteSpace(entries[0])) {
-      console.log(i18n.__('fileHasWhiteSpacesError'))
-      process.exit(1)
-    }
-
-    if (fileFinder.fileIsEmpty(entries[0])) {
-      console.log(i18n.__('scanFileIsEmpty'))
-      process.exit(1)
-    }
-
-    configToUse.file = entries[0]
-    if (configToUse.name === undefined) {
-      configToUse.name = entries[0]
-    }
-  } else {
-    errorOnFileDetection(entries)
-  }
-}
-
-const autoDetectAuditFilesAndLanguages = async filePath => {
-  let languagesFound = []
-
-  console.log(i18n.__('searchingAuditFileDirectory', filePath))
-
-  await fileFinder.findFilesJava(languagesFound, filePath)
-  await fileFinder.findFilesJavascript(languagesFound, filePath)
-  await fileFinder.findFilesPython(languagesFound, filePath)
-  await fileFinder.findFilesGo(languagesFound, filePath)
-  await fileFinder.findFilesPhp(languagesFound, filePath)
-  await fileFinder.findFilesRuby(languagesFound, filePath)
-  await fileFinder.findFilesDotNet(languagesFound, filePath)
-
-  if (languagesFound) {
-    return languagesFound
-  }
-
-  return []
-}
-
-const hasWhiteSpace = s => {
-  const filename = s.split('/').pop()
-  return filename.indexOf(' ') >= 0
-}
-
-const dealWithMultiJava = filesFound => {
-  let hasMultiJava =
-    filesFound.filter(data => {
-      return (
-        Object.keys(data)[0] === JAVA &&
-        Object.values(data)[0].includes('build.gradle') &&
-        Object.values(data)[0].includes('pom.xml')
-      )
-    }).length > 0
-  if (hasMultiJava) {
-    console.log('Multiple Java language dependency files detected')
-    console.log(
-      'Please use --file to audit one only. \nExample: contrast audit --file pom.xml'
-    )
-    process.exit(1)
-  }
-  return false
-}
-
-const errorOnFileDetection = entries => {
-  if (entries.length > 1) {
-    console.log(i18n.__('searchingDirectoryScan'))
-    for (let file in entries) {
-      console.log('-', entries[file])
-    }
-    console.log('')
-    console.log(i18n.__('specifyFileScanError'))
-  } else {
-    console.log(i18n.__('noFileFoundScan'))
-    console.log('')
-    console.log(i18n.__('specifyFileScanError'))
-  }
-  process.exit(1)
-}
-
-const errorOnAuditFileDetection = entries => {
-  if (entries.length > 1) {
-    console.log(i18n.__('searchingDirectoryScan'))
-    for (let file in entries) {
-      console.log('-', entries[file])
-    }
-    console.log('')
-    console.log(i18n.__('specifyFileAuditNotFound'))
-  } else {
-    console.log(i18n.__('noFileFoundScan'))
-    console.log('')
-    console.log(i18n.__('specifyFileAuditNotFound'))
-  }
-}
-
-module.exports = {
-  autoDetectFileAndLanguage,
-  errorOnFileDetection,
-  autoDetectAuditFilesAndLanguages,
-  errorOnAuditFileDetection,
-  autoDetectFingerprintInfo,
-  dealWithMultiJava,
-  detectPackageManager
-}

package/src/scan/fileUtils.js

@@ -1,206 +0,0 @@
-const fg = require('fast-glob')
-const fs = require('fs')
-const i18n = require('i18n')
-
-const findFile = async () => {
-  console.log(i18n.__('searchingScanFileDirectory', process.cwd()))
-  return fg(['**/*.jar', '**/*.war', '**/*.zip', '**/*.dll', '**/*.exe'], {
-    dot: false,
-    deep: 3,
-    onlyFiles: true
-  })
-}
-
-const findAllFiles = async (filePath, depth = 2) => {
-  const result = await fg(
-    [
-      '**/pom.xml',
-      '**/build.gradle',
-      '**/build.gradle.kts',
-      '**/package.json',
-      '**/package-lock.json',
-      '**/yarn.lock',
-      '**/Pipfile',
-      '**/*.csproj',
-      '**/Gemfile',
-      '**/go.mod'
-    ],
-    {
-      dot: false,
-      deep: depth,
-      onlyFiles: true,
-      absolute: true,
-      cwd: filePath ? filePath : process.cwd()
-    }
-  )
-
-  if (result.length > 0) {
-    return result
-  }
-  return []
-}
-
-const findFilesJava = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(
-    ['**/pom.xml', '**/build.gradle', '**/build.gradle.kts'],
-    {
-      dot: false,
-      deep: depth,
-      onlyFiles: true,
-      cwd: filePath ? filePath : process.cwd()
-    }
-  )
-
-  if (result.length > 0) {
-    let lockFile = result.find(i => i.includes('pom') || i.includes('gradle'))
-    return languagesFound.push({
-      JAVA: result,
-      language: 'JAVA',
-      filePath: lockFile
-    })
-  }
-  return languagesFound
-}
-
-const findFilesJavascript = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(
-    ['**/package.json', '**/yarn.lock', '**/package-lock.json'],
-    {
-      dot: false,
-      deep: depth,
-      onlyFiles: true,
-      cwd: filePath ? filePath : process.cwd()
-    }
-  )
-
-  if (result.length > 0) {
-    let lockFile = result.find(i => i.includes('lock'))
-    return languagesFound.push({
-      JAVASCRIPT: result,
-      language: 'JAVASCRIPT',
-      filePath: lockFile
-    })
-  }
-  return languagesFound
-}
-
-const findFilesPython = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/Pipfile.lock', '**/Pipfile'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({ PYTHON: result, filePath: 'Pipfile' })
-  }
-  return languagesFound
-}
-
-const findFilesGo = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/go.mod'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({ GO: result, filePath: 'go.mod' })
-  }
-  return languagesFound
-}
-
-const findFilesRuby = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/Gemfile', '**/Gemfile.lock'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({ RUBY: result, filePath: 'Gemfile' })
-  }
-  return languagesFound
-}
-
-const findFilesPhp = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/composer.json', '**/composer.lock'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({ PHP: result, filePath: 'composer.lock' })
-  }
-  return languagesFound
-}
-
-const findFilesDotNet = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/*.csproj', '**/packages.lock.json'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({
-      DOTNET: result,
-      filePath: 'packages.lock.json'
-    })
-  }
-  return languagesFound
-}
-
-const checkFilePermissions = file => {
-  let readableFile = false
-  try {
-    fs.accessSync(file, fs.constants.R_OK)
-    return (readableFile = true) // testing purposes
-  } catch (err) {
-    console.log('Invalid permissions found on ', file)
-    process.exit(0)
-  }
-}
-
-const fileExists = path => {
-  return fs.existsSync(path)
-}
-
-const fileIsEmpty = path => {
-  if (fileExists(path) && checkFilePermissions(path)) {
-    try {
-      return fs.readFileSync(path).length === 0
-    } catch (e) {
-      if (
-        e.message.toString().includes('illegal operation on a directory, read')
-      ) {
-        console.log('file provided cannot be a directory')
-      } else {
-        console.log(e.message.toString())
-      }
-      process.exit(0)
-    }
-  }
-  return false
-}
-
-module.exports = {
-  findFile,
-  fileExists,
-  checkFilePermissions,
-  findFilesJava,
-  findFilesJavascript,
-  findFilesPython,
-  findFilesGo,
-  findFilesPhp,
-  findFilesRuby,
-  findFilesDotNet,
-  fileIsEmpty,
-  findAllFiles
-}

package/src/scan/formatScanOutput.ts

@@ -1,225 +0,0 @@
-import { ScanResultsModel } from './models/scanResultsModel'
-import i18n from 'i18n'
-import chalk from 'chalk'
-import { ResultContent } from './models/resultContentModel'
-import { GroupedResultsModel } from './models/groupedResultsModel'
-import { sortBy } from 'lodash'
-import Table from 'cli-table3'
-import {
-  CRITICAL_COLOUR,
-  HIGH_COLOUR,
-  LOW_COLOUR,
-  MEDIUM_COLOUR,
-  NOTE_COLOUR,
-  supportedLanguagesScan
-} from '../constants/constants'
-import {
-  getSeverityCounts,
-  printVulnInfo
-} from '../audit/report/commonReportingFunctions'
-
-export function formatScanOutput(scanResults: ScanResultsModel) {
-  const { content } = scanResults.scanResultsInstances
-  const { language } = scanResults.scanDetail
-
-  const severityCounts = getSeverityCounts(content)
-  if (content.length === 0) {
-    console.log(i18n.__('scanNoVulnerabilitiesFound'))
-    console.log(i18n.__('scanNoVulnerabilitiesFoundSecureCode'))
-    console.log(i18n.__('scanNoVulnerabilitiesFoundGoodWork'))
-  } else {
-    const message =
-      severityCounts.critical || severityCounts.high
-        ? 'Here are your top priorities to fix'
-        : "No major issues, here's what we found"
-    console.log(chalk.bold(message))
-    console.log()
-
-    const defaultView = getDefaultView(content, language)
-
-    let count = 0
-    defaultView.forEach(entry => {
-      count++
-      const table = new Table({
-        chars: {
-          top: '',
-          'top-mid': '',
-          'top-left': '',
-          'top-right': '',
-          bottom: '',
-          'bottom-mid': '',
-          'bottom-left': '',
-          'bottom-right': '',
-          left: '',
-          'left-mid': '',
-          mid: '',
-          'mid-mid': '',
-          right: '',
-          'right-mid': '',
-          middle: ' '
-        },
-        style: { 'padding-left': 0, 'padding-right': 0 },
-        colAligns: ['right'],
-        wordWrap: true,
-        colWidths: [12, 1, 100]
-      })
-
-      let learnRow: string[] = []
-      let adviceRow = []
-      const headerColour = chalk.hex(entry.colour)
-      const headerRow = [
-        headerColour(`CONTRAST-${count.toString().padStart(3, '0')}`),
-        headerColour(`-`),
-        headerColour(`[${entry.severity}] `) +
-          headerColour.bold(`${entry.ruleId}`) +
-          entry.message
-      ]
-
-      const codePath = entry.codePath?.replace(/^@/, '')
-
-      const codeRow = [
-        chalk.hex('#F6F5F5').bold(`Code`),
-        chalk.hex('#F6F5F5').bold(`:`),
-        chalk.hex('#F6F5F5').bold(`${codePath}`)
-      ]
-      const issueRow = [chalk.bold(`Issue`), chalk.bold(`:`), `${entry.issue}`]
-
-      table.push(headerRow, codeRow, issueRow)
-
-      if (entry?.advice) {
-        adviceRow = [
-          chalk.bold('Advice'),
-          chalk.bold(`:`),
-          stripTags(entry.advice)
-        ]
-        table.push(adviceRow)
-      }
-
-      if (entry?.learn && entry?.learn.length > 0) {
-        learnRow = [
-          chalk.bold('Learn'),
-          chalk.bold(`:`),
-          chalk.hex('#97f7f7').bold.underline(entry.learn[0])
-        ]
-        table.push(learnRow)
-      }
-      console.log(table.toString())
-      console.log()
-    })
-  }
-  printVulnInfo(severityCounts)
-
-  return severityCounts
-}
-
-export function formatLinks(objName: string, entry: any[]) {
-  const line = chalk.bold(objName + '  : ')
-  if (entry.length === 1) {
-    console.log(line + chalk.hex('#97DCF7').bold.underline(entry[0]))
-  } else {
-    console.log(line)
-    entry.forEach(link => {
-      console.log(chalk.hex('#97DCF7').bold.underline(link))
-    })
-  }
-}
-
-export function getDefaultView(content: ResultContent[], language: string) {
-  const groupTypeResults = [] as GroupedResultsModel[]
-
-  content.forEach(resultEntry => {
-    const groupResultsObj = new GroupedResultsModel(resultEntry.ruleId)
-    groupResultsObj.severity = resultEntry.severity
-    groupResultsObj.ruleId = resultEntry.ruleId
-    groupResultsObj.issue = stripTags(resultEntry.issue)
-    groupResultsObj.advice = resultEntry.advice
-    groupResultsObj.learn = resultEntry.learn
-    groupResultsObj.message = resultEntry.message?.text
-      ? editVulName(resultEntry.message.text) +
-        doAddSourceLineNumber(resultEntry, language)
-      : ''
-    groupResultsObj.codePath = getLocationsSyncInfo(resultEntry)
-    groupTypeResults.push(groupResultsObj)
-    assignBySeverity(resultEntry, groupResultsObj)
-  })
-
-  return sortBy(groupTypeResults, ['priority'])
-}
-
-export function doAddSourceLineNumber(
-  resultEntry: ResultContent,
-  language: string
-) {
-  //only add source line num if not JS
-  return language !== supportedLanguagesScan.JAVASCRIPT
-    ? ':' + getSourceLineNumber(resultEntry)
-    : ''
-}
-
-export function editVulName(message: string) {
-  return message.substring(message.indexOf(' in '))
-}
-
-export function getLocationsSyncInfo(resultEntry: ResultContent) {
-  const locationsMessage =
-    resultEntry.locations[0]?.physicalLocation?.artifactLocation?.uri || ''
-  const locationsLineNumber =
-    resultEntry.locations[0]?.physicalLocation?.region?.startLine || ''
-
-  if (!locationsLineNumber) {
-    return '@' + locationsMessage
-  }
-
-  return '@' + locationsMessage + ':' + locationsLineNumber
-}
-
-export function getSourceLineNumber(resultEntry: ResultContent) {
-  const locationsLineNumber =
-    resultEntry.locations[0]?.physicalLocation?.region?.startLine || ''
-  const codeFlowLineNumber = getCodeFlowInfo(resultEntry)
-
-  return codeFlowLineNumber ? codeFlowLineNumber : locationsLineNumber
-}
-
-export function getCodeFlowInfo(resultEntry: ResultContent) {
-  let result: any
-  resultEntry.codeFlows[0]?.threadFlows.forEach((i: { locations: any[] }) => {
-    return (result = i.locations.find(
-      (locations: { importance: string }) =>
-        locations.importance === 'essential'
-    ))
-  })
-
-  return result?.location?.physicalLocation?.region?.startLine
-}
-
-export function stripTags(oldString: string) {
-  return oldString.replace(/\n/g, ' ').replace(/\s+/g, ' ').trim()
-}
-
-export function assignBySeverity(
-  entry: ResultContent,
-  assignedObj: GroupedResultsModel
-) {
-  if (entry.severity.toUpperCase() === 'CRITICAL') {
-    assignedObj.priority = 1
-    assignedObj.colour = CRITICAL_COLOUR
-    return assignedObj
-  } else if (entry.severity.toUpperCase() === 'HIGH') {
-    assignedObj.priority = 2
-    assignedObj.colour = HIGH_COLOUR
-    return assignedObj
-  } else if (entry.severity.toUpperCase() === 'MEDIUM') {
-    assignedObj.priority = 3
-    assignedObj.colour = MEDIUM_COLOUR
-    return assignedObj
-  } else if (entry.severity.toUpperCase() === 'LOW') {
-    assignedObj.priority = 4
-    assignedObj.colour = LOW_COLOUR
-    return assignedObj
-  } else if (entry.severity.toUpperCase() === 'NOTE') {
-    assignedObj.priority = 5
-    assignedObj.colour = NOTE_COLOUR
-    return assignedObj
-  }
-}

package/src/scan/help.js

@@ -1,56 +0,0 @@
-const commandLineUsage = require('command-line-usage')
-const i18n = require('i18n')
-const constants = require('../cliConstants')
-const { commonHelpLinks } = require('../common/commonHelp')
-
-const scanUsageGuide = commandLineUsage([
-  {
-    header: i18n.__('constantsHeader')
-  },
-  {
-    header: i18n.__('scanHeader')
-  },
-  {
-    header: i18n.__('constantsPrerequisitesHeader'),
-    content: [
-      '{bold ' + i18n.__('constantsPrerequisitesContentScanLanguages') + '}',
-      i18n.__('constantsPrerequisitesContent'),
-      '',
-      i18n.__('constantsUsageCommandInfo'),
-      i18n.__('constantsUsageCommandInfo24Hours')
-    ]
-  },
-  {
-    header: i18n.__('constantsScanOptions'),
-    optionList: constants.commandLineDefinitions.scanOptionDefinitions,
-    hide: [
-      'project-id',
-      'organization-id',
-      'api-key',
-      'authorization',
-      'host',
-      'proxy',
-      'help',
-      'ff',
-      'cert-self-signed',
-      'key',
-      'cacert',
-      'cert',
-      'verbose',
-      'debug',
-      'experimental'
-    ]
-  },
-  {
-    header: i18n.__('constantsAdvancedOptions'),
-    optionList:
-      constants.commandLineDefinitions.scanAdvancedOptionDefinitionsForHelp
-  },
-  commonHelpLinks()[0],
-  commonHelpLinks()[1],
-  commonHelpLinks()[2]
-])
-
-module.exports = {
-  scanUsageGuide
-}

package/src/scan/models/groupedResultsModel.ts

@@ -1,20 +0,0 @@
-export class GroupedResultsModel {
-  ruleId: string
-  codePathSet: Set<string>
-  cwe?: string[]
-  reference?: string[]
-  severity?: string
-  advice?: string
-  learn?: string[]
-  issue?: string
-  priority?: number
-  message?: string | undefined
-  colour: string
-  codePath?: string
-
-  constructor(ruleId: string) {
-    this.ruleId = ruleId
-    this.colour = '#999999'
-    this.codePathSet = new Set<string>()
-  }
-}