@contrast/contrast 2.0.2-beta.2 → 2.0.2-beta.4

package/src/scaAnalysis/scaAnalysis.js

@@ -1,172 +0,0 @@
-const {
-  supportedLanguages: { JAVA, GO, PYTHON, RUBY, JAVASCRIPT, NODE, PHP, DOTNET }
-} = require('../constants/constants')
-const {
-  returnOra,
-  startSpinner,
-  succeedSpinner
-} = require('../utils/oraWrapper')
-const autoDetection = require('../common/autoDetection')
-const rootFile = require('../audit/languageAnalysisEngine/getProjectRootFilenames')
-const path = require('path')
-const i18n = require('i18n')
-const { auditUsageGuide } = require('../commands/audit/help')
-const repoMode = require('./repoMode')
-const { dotNetAnalysis } = require('./dotnet')
-const { goAnalysis } = require('./go/goAnalysis')
-const { phpAnalysis } = require('./php')
-const { rubyAnalysis } = require('./ruby')
-const { pythonAnalysis } = require('./python')
-const javaAnalysis = require('./java')
-const jsAnalysis = require('./javascript')
-const auditReport = require('./common/auditReport')
-const processServices = require('./processServicesFlow')
-const chalk = require('chalk')
-const {
-  convertGenericToTypedReportModelSca
-} = require('./common/utils/reportUtilsSca')
-const projectConfig = require('../commands/github/projectGroup')
-const { legacyFlow } = require('./legacy/legacyFlow')
-
-const processSca = async config => {
-  let filesFound
-
-  if (config.help) {
-    console.log(auditUsageGuide)
-    process.exit(0)
-  }
-
-  config.repo = config.repositoryId !== undefined
-
-  const projectStats = await rootFile.getProjectStats(config.file)
-  let pathWithFile = projectStats.isFile()
-
-  config.fileName = config.file
-  config.file = pathWithFile
-    ? rootFile.getDirectoryFromPathGiven(config.file).concat('/')
-    : config.file
-
-  filesFound = await autoDetection.autoDetectAuditFilesAndLanguages(config.file)
-  filesFound = await autoDetection.detectPackageManager(filesFound)
-
-  autoDetection.dealWithMultiJava(filesFound, config, pathWithFile)
-
-  if (filesFound.length > 1 && pathWithFile) {
-    filesFound = filesFound.filter(i =>
-      Object.values(i)[0].includes(path.basename(config.fileName))
-    )
-  }
-
-  // files found looks like [ { javascript: [ Array ] } ]
-  //check we have the language and call the right analyser
-  let messageToSend = undefined
-  if (filesFound.length === 1) {
-    config.packageManager = filesFound[0]?.packageManager
-    switch (Object.keys(filesFound[0])[0]) {
-      case JAVA:
-        config.language = JAVA
-        if (config.repo && !config.legacy) {
-          try {
-            messageToSend = await repoMode.buildRepo(config, filesFound[0])
-          } catch (e) {
-            throw new Error(
-              'Unable to build in repository mode. Check your project file'
-            )
-          }
-        } else {
-          messageToSend = await javaAnalysis.javaAnalysis(config, filesFound[0])
-        }
-        break
-      case JAVASCRIPT:
-        messageToSend = await jsAnalysis.jsAnalysis(config, filesFound[0])
-        config.language = NODE
-        break
-      case PYTHON:
-        messageToSend = pythonAnalysis(config, filesFound[0])
-        config.language = PYTHON
-        break
-      case RUBY:
-        messageToSend = rubyAnalysis(config, filesFound[0])
-        config.language = RUBY
-        break
-      case PHP:
-        messageToSend = phpAnalysis(config, filesFound[0])
-        config.language = PHP
-        break
-      case GO:
-        messageToSend = goAnalysis(config, filesFound[0])
-        config.language = GO
-        break
-      case DOTNET:
-        if (config.legacy === false) {
-          console.log(
-            `${chalk.bold(
-              '\n.NET project found\n'
-            )} Language type is unsupported.`
-          )
-          return
-        } else {
-          messageToSend = dotNetAnalysis(config, filesFound[0])
-          config.language = DOTNET
-          break
-        }
-      default:
-        //something is wrong
-        console.log('No supported language detected in project path')
-        return
-    }
-
-    if (config.legacy === false) {
-      if (!config.name) {
-        config = await projectConfig.dealWithNoName(config)
-      }
-      const startTime = performance.now()
-      console.log('') //empty log for space before spinner
-      const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'))
-      startSpinner(reportSpinner)
-
-      let reportResponse = await processServices.processUpload(
-        messageToSend,
-        config,
-        reportSpinner
-      )
-
-      const reportModelLibraryList = convertGenericToTypedReportModelSca(
-        reportResponse.reportArray
-      )
-      await auditReport.processAuditReport(
-        config,
-        reportModelLibraryList,
-        reportResponse.reportId
-      )
-
-      succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'))
-
-      const endTime = performance.now() - startTime
-      const scanDurationMs = endTime - startTime
-      console.log(
-        `----- completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`
-      )
-    } else {
-      await legacyFlow(config, messageToSend)
-    }
-  } else {
-    if (filesFound.length === 0) {
-      console.log(i18n.__('languageAnalysisNoLanguage'))
-      console.log(i18n.__('languageAnalysisNoLanguageHelpLine'))
-      throw new Error()
-    } else {
-      console.log(chalk.bold(`\nMultiple language files detected \n`))
-      filesFound.forEach(file => {
-        console.log(`${Object.keys(file)[0]} : `, Object.values(file)[0])
-      })
-      throw new Error(
-        `Please use --file to audit one language only. \nExample: contrast audit --file package-lock.json`
-      )
-    }
-  }
-}
-
-module.exports = {
-  processSca
-}

package/src/scan/fileUtils.js

@@ -1,218 +0,0 @@
-const fg = require('fast-glob')
-const fs = require('fs')
-const i18n = require('i18n')
-
-const findFile = async () => {
-  console.log(i18n.__('searchingScanFileDirectory', process.cwd()))
-  return fg(['**/*.jar', '**/*.war', '**/*.zip', '**/*.dll', '**/*.exe'], {
-    dot: false,
-    deep: 3,
-    onlyFiles: true
-  })
-}
-
-const findAllFiles = async (filePath, depth = 3) => {
-  const result = await fg(
-    [
-      '**/pom.xml',
-      // '**/build.gradle',
-      // '**/build.gradle.kts',
-      '**/package.json',
-      '**/package-lock.json',
-      '**/yarn.lock'
-      // '**/Pipfile',
-      // '**/*.csproj',
-      // '**/Gemfile',
-      // '**/go.mod'
-    ],
-    {
-      ignore: ['**/node_modules/**', '**/target/**', '**/bin/**'],
-      dot: false,
-      deep: depth,
-      onlyFiles: true,
-      absolute: true,
-      cwd: filePath ? filePath : process.cwd()
-    }
-  )
-
-  if (result.length > 0) {
-    return result
-  }
-  return []
-}
-
-const findFilesJava = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(
-    ['**/pom.xml', '**/build.gradle', '**/build.gradle.kts'],
-    {
-      dot: false,
-      deep: depth,
-      onlyFiles: true,
-      cwd: filePath ? filePath : process.cwd()
-    }
-  )
-
-  if (result.length > 0) {
-    let lockFile = result.find(i => i.includes('pom') || i.includes('gradle'))
-    return languagesFound.push({
-      JAVA: result,
-      language: 'JAVA',
-      filePath: lockFile
-    })
-  }
-  return languagesFound
-}
-
-const findFilesJavascript = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(
-    ['**/package.json', '**/yarn.lock', '**/package-lock.json'],
-    {
-      dot: false,
-      deep: depth,
-      onlyFiles: true,
-      cwd: filePath ? filePath : process.cwd()
-    }
-  )
-
-  if (result.length > 0) {
-    let lockFile = result.find(i => i.includes('lock'))
-    return languagesFound.push({
-      JAVASCRIPT: result,
-      language: 'JAVASCRIPT',
-      filePath: lockFile
-    })
-  }
-  return languagesFound
-}
-
-const findFilesPython = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/Pipfile.lock', '**/Pipfile'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({ PYTHON: result, filePath: 'Pipfile' })
-  }
-  return languagesFound
-}
-
-const findFilesGo = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/go.mod'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({ GO: result, filePath: 'go.mod' })
-  }
-  return languagesFound
-}
-
-const findFilesRuby = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/Gemfile', '**/Gemfile.lock'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({ RUBY: result, filePath: 'Gemfile' })
-  }
-  return languagesFound
-}
-
-const findFilesPhp = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/composer.json', '**/composer.lock'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({ PHP: result, filePath: 'composer.lock' })
-  }
-  return languagesFound
-}
-
-const findFilesDotNet = async (languagesFound, filePath, depth = 1) => {
-  const result = await fg(['**/*.csproj', '**/packages.lock.json'], {
-    dot: false,
-    deep: depth,
-    onlyFiles: true,
-    cwd: filePath ? filePath : process.cwd()
-  })
-
-  if (result.length > 0) {
-    return languagesFound.push({
-      DOTNET: result,
-      filePath: 'packages.lock.json'
-    })
-  }
-  return languagesFound
-}
-
-const checkFilePermissions = file => {
-  let readableFile = false
-  try {
-    fs.accessSync(file, fs.constants.R_OK)
-    return (readableFile = true) // testing purposes
-  } catch (err) {
-    console.log('Invalid permissions found on ', file)
-    process.exit(0)
-  }
-}
-
-const fileExists = path => {
-  return fs.existsSync(path)
-}
-
-const fileIsEmpty = path => {
-  if (fileExists(path) && checkFilePermissions(path)) {
-    try {
-      return fs.readFileSync(path).length === 0
-    } catch (e) {
-      if (
-        e.message.toString().includes('illegal operation on a directory, read')
-      ) {
-        console.log('file provided cannot be a directory')
-      } else {
-        console.log(e.message.toString())
-      }
-      process.exit(0)
-    }
-  }
-  return false
-}
-
-const shortenFilePath = filePath => {
-  let splitPath = filePath.split('home/runner/work/')
-  if (splitPath.length > 1) {
-    let splitPath2 = splitPath[1].split('/')
-    splitPath2.shift()
-    return splitPath2.join('/').toString()
-  }
-  return filePath
-}
-
-module.exports = {
-  findFile,
-  fileExists,
-  checkFilePermissions,
-  findFilesJava,
-  findFilesJavascript,
-  findFilesPython,
-  findFilesGo,
-  findFilesPhp,
-  findFilesRuby,
-  findFilesDotNet,
-  fileIsEmpty,
-  findAllFiles,
-  shortenFilePath
-}

package/src/scan/formatScanOutput.ts

@@ -1,225 +0,0 @@
-import { ScanResultsModel } from './models/scanResultsModel'
-import i18n from 'i18n'
-import chalk from 'chalk'
-import { ResultContent } from './models/resultContentModel'
-import { GroupedResultsModel } from './models/groupedResultsModel'
-import { sortBy } from 'lodash'
-import Table from 'cli-table3'
-import {
-  CRITICAL_COLOUR,
-  HIGH_COLOUR,
-  LOW_COLOUR,
-  MEDIUM_COLOUR,
-  NOTE_COLOUR,
-  supportedLanguagesScan
-} from '../constants/constants'
-import {
-  getSeverityCounts,
-  printVulnInfo
-} from '../audit/report/commonReportingFunctions'
-
-export function formatScanOutput(scanResults: ScanResultsModel) {
-  const { content } = scanResults.scanResultsInstances
-  const { language } = scanResults.scanDetail
-
-  const severityCounts = getSeverityCounts(content)
-  if (content.length === 0) {
-    console.log(i18n.__('scanNoVulnerabilitiesFound'))
-    console.log(i18n.__('scanNoVulnerabilitiesFoundSecureCode'))
-    console.log(i18n.__('scanNoVulnerabilitiesFoundGoodWork'))
-  } else {
-    const message =
-      severityCounts.critical || severityCounts.high
-        ? 'Here are your top priorities to fix'
-        : "No major issues, here's what we found"
-    console.log(chalk.bold(message))
-    console.log()
-
-    const defaultView = getDefaultView(content, language)
-
-    let count = 0
-    defaultView.forEach(entry => {
-      count++
-      const table = new Table({
-        chars: {
-          top: '',
-          'top-mid': '',
-          'top-left': '',
-          'top-right': '',
-          bottom: '',
-          'bottom-mid': '',
-          'bottom-left': '',
-          'bottom-right': '',
-          left: '',
-          'left-mid': '',
-          mid: '',
-          'mid-mid': '',
-          right: '',
-          'right-mid': '',
-          middle: ' '
-        },
-        style: { 'padding-left': 0, 'padding-right': 0 },
-        colAligns: ['right'],
-        wordWrap: true,
-        colWidths: [12, 1, 100]
-      })
-
-      let learnRow: string[] = []
-      let adviceRow = []
-      const headerColour = chalk.hex(entry.colour)
-      const headerRow = [
-        headerColour(`CONTRAST-${count.toString().padStart(3, '0')}`),
-        headerColour(`-`),
-        headerColour(`[${entry.severity}] `) +
-          headerColour.bold(`${entry.ruleId}`) +
-          entry.message
-      ]
-
-      const codePath = entry.codePath?.replace(/^@/, '')
-
-      const codeRow = [
-        chalk.hex('#F6F5F5').bold(`Code`),
-        chalk.hex('#F6F5F5').bold(`:`),
-        chalk.hex('#F6F5F5').bold(`${codePath}`)
-      ]
-      const issueRow = [chalk.bold(`Issue`), chalk.bold(`:`), `${entry.issue}`]
-
-      table.push(headerRow, codeRow, issueRow)
-
-      if (entry?.advice) {
-        adviceRow = [
-          chalk.bold('Advice'),
-          chalk.bold(`:`),
-          stripTags(entry.advice)
-        ]
-        table.push(adviceRow)
-      }
-
-      if (entry?.learn && entry?.learn.length > 0) {
-        learnRow = [
-          chalk.bold('Learn'),
-          chalk.bold(`:`),
-          chalk.hex('#97f7f7').bold.underline(entry.learn[0])
-        ]
-        table.push(learnRow)
-      }
-      console.log(table.toString())
-      console.log()
-    })
-  }
-  printVulnInfo(severityCounts)
-
-  return severityCounts
-}
-
-export function formatLinks(objName: string, entry: any[]) {
-  const line = chalk.bold(objName + '  : ')
-  if (entry.length === 1) {
-    console.log(line + chalk.hex('#97DCF7').bold.underline(entry[0]))
-  } else {
-    console.log(line)
-    entry.forEach(link => {
-      console.log(chalk.hex('#97DCF7').bold.underline(link))
-    })
-  }
-}
-
-export function getDefaultView(content: ResultContent[], language: string) {
-  const groupTypeResults = [] as GroupedResultsModel[]
-
-  content.forEach(resultEntry => {
-    const groupResultsObj = new GroupedResultsModel(resultEntry.ruleId)
-    groupResultsObj.severity = resultEntry.severity
-    groupResultsObj.ruleId = resultEntry.ruleId
-    groupResultsObj.issue = stripTags(resultEntry.issue)
-    groupResultsObj.advice = resultEntry.advice
-    groupResultsObj.learn = resultEntry.learn
-    groupResultsObj.message = resultEntry.message?.text
-      ? editVulName(resultEntry.message.text) +
-        doAddSourceLineNumber(resultEntry, language)
-      : ''
-    groupResultsObj.codePath = getLocationsSyncInfo(resultEntry)
-    groupTypeResults.push(groupResultsObj)
-    assignBySeverity(resultEntry, groupResultsObj)
-  })
-
-  return sortBy(groupTypeResults, ['priority'])
-}
-
-export function doAddSourceLineNumber(
-  resultEntry: ResultContent,
-  language: string
-) {
-  //only add source line num if not JS
-  return language !== supportedLanguagesScan.JAVASCRIPT
-    ? ':' + getSourceLineNumber(resultEntry)
-    : ''
-}
-
-export function editVulName(message: string) {
-  return message.substring(message.indexOf(' in '))
-}
-
-export function getLocationsSyncInfo(resultEntry: ResultContent) {
-  const locationsMessage =
-    resultEntry.locations[0]?.physicalLocation?.artifactLocation?.uri || ''
-  const locationsLineNumber =
-    resultEntry.locations[0]?.physicalLocation?.region?.startLine || ''
-
-  if (!locationsLineNumber) {
-    return '@' + locationsMessage
-  }
-
-  return '@' + locationsMessage + ':' + locationsLineNumber
-}
-
-export function getSourceLineNumber(resultEntry: ResultContent) {
-  const locationsLineNumber =
-    resultEntry.locations[0]?.physicalLocation?.region?.startLine || ''
-  const codeFlowLineNumber = getCodeFlowInfo(resultEntry)
-
-  return codeFlowLineNumber ? codeFlowLineNumber : locationsLineNumber
-}
-
-export function getCodeFlowInfo(resultEntry: ResultContent) {
-  let result: any
-  resultEntry.codeFlows[0]?.threadFlows.forEach((i: { locations: any[] }) => {
-    return (result = i.locations.find(
-      (locations: { importance: string }) =>
-        locations.importance === 'essential'
-    ))
-  })
-
-  return result?.location?.physicalLocation?.region?.startLine
-}
-
-export function stripTags(oldString: string) {
-  return oldString.replace(/\n/g, ' ').replace(/\s+/g, ' ').trim()
-}
-
-export function assignBySeverity(
-  entry: ResultContent,
-  assignedObj: GroupedResultsModel
-) {
-  if (entry.severity.toUpperCase() === 'CRITICAL') {
-    assignedObj.priority = 1
-    assignedObj.colour = CRITICAL_COLOUR
-    return assignedObj
-  } else if (entry.severity.toUpperCase() === 'HIGH') {
-    assignedObj.priority = 2
-    assignedObj.colour = HIGH_COLOUR
-    return assignedObj
-  } else if (entry.severity.toUpperCase() === 'MEDIUM') {
-    assignedObj.priority = 3
-    assignedObj.colour = MEDIUM_COLOUR
-    return assignedObj
-  } else if (entry.severity.toUpperCase() === 'LOW') {
-    assignedObj.priority = 4
-    assignedObj.colour = LOW_COLOUR
-    return assignedObj
-  } else if (entry.severity.toUpperCase() === 'NOTE') {
-    assignedObj.priority = 5
-    assignedObj.colour = NOTE_COLOUR
-    return assignedObj
-  }
-}

package/src/scan/help.js

@@ -1,56 +0,0 @@
-const commandLineUsage = require('command-line-usage')
-const i18n = require('i18n')
-const constants = require('../cliConstants')
-const { commonHelpLinks } = require('../common/commonHelp')
-
-const scanUsageGuide = commandLineUsage([
-  {
-    header: i18n.__('constantsHeader')
-  },
-  {
-    header: i18n.__('scanHeader')
-  },
-  {
-    header: i18n.__('constantsPrerequisitesHeader'),
-    content: [
-      '{bold ' + i18n.__('constantsPrerequisitesContentScanLanguages') + '}',
-      i18n.__('constantsPrerequisitesContent'),
-      '',
-      i18n.__('constantsUsageCommandInfo'),
-      i18n.__('constantsUsageCommandInfo24Hours')
-    ]
-  },
-  {
-    header: i18n.__('constantsScanOptions'),
-    optionList: constants.commandLineDefinitions.scanOptionDefinitions,
-    hide: [
-      'project-id',
-      'organization-id',
-      'api-key',
-      'authorization',
-      'host',
-      'proxy',
-      'help',
-      'ff',
-      'cert-self-signed',
-      'key',
-      'cacert',
-      'cert',
-      'verbose',
-      'debug',
-      'experimental'
-    ]
-  },
-  {
-    header: i18n.__('constantsAdvancedOptions'),
-    optionList:
-      constants.commandLineDefinitions.scanAdvancedOptionDefinitionsForHelp
-  },
-  commonHelpLinks()[0],
-  commonHelpLinks()[1],
-  commonHelpLinks()[2]
-])
-
-module.exports = {
-  scanUsageGuide
-}

package/src/scan/models/groupedResultsModel.ts

@@ -1,20 +0,0 @@
-export class GroupedResultsModel {
-  ruleId: string
-  codePathSet: Set<string>
-  cwe?: string[]
-  reference?: string[]
-  severity?: string
-  advice?: string
-  learn?: string[]
-  issue?: string
-  priority?: number
-  message?: string | undefined
-  colour: string
-  codePath?: string
-
-  constructor(ruleId: string) {
-    this.ruleId = ruleId
-    this.colour = '#999999'
-    this.codePathSet = new Set<string>()
-  }
-}