@contrast/contrast 2.0.2-beta.3 → 2.0.2-beta.4

package/src/common/autoDetection.js

@@ -1,209 +0,0 @@
-const i18n = require('i18n')
-const fileFinder = require('../scan/fileUtils')
-const {
-  supportedLanguages: { JAVA, GO, PYTHON, RUBY, JAVASCRIPT, DOTNET }
-} = require('../constants/constants')
-const { shortenFilePath } = require('../scan/fileUtils')
-
-const autoDetectFingerprintInfo = async (filePath, depth, config) => {
-  let complexObj = await fileFinder.findAllFiles(filePath, depth)
-  let result = []
-  let count = 0
-  complexObj.forEach(i => {
-    count++
-    if (!i.includes('package.json')) {
-      result.push({
-        name: shortenFilePath(i),
-        filePath: i,
-        id: count.toString(),
-        repositoryId: config.repositoryId,
-        projectGroupId: config.projectGroupId
-      })
-    }
-  })
-  return result
-}
-
-const detectPackageManager = async array => {
-  array.forEach(i => {
-    if (i.filePath.includes('pom.xml')) {
-      i['language'] = JAVA
-      i['packageManager'] = 'MAVEN'
-    }
-    if (i.filePath.includes('build.gradle.kts')) {
-      i['language'] = JAVA
-      i['packageManager'] = 'GRADLE'
-    }
-    if (i.filePath.includes('build.gradle')) {
-      i['language'] = JAVA
-      i['packageManager'] = 'GRADLE'
-    }
-    if (i.filePath.includes('package-lock.json')) {
-      i['language'] = JAVASCRIPT
-      i['packageManager'] = 'NPM'
-    }
-    if (i.filePath.includes('yarn.lock')) {
-      i['language'] = JAVASCRIPT
-      i['packageManager'] = 'YARN'
-    }
-    if (i.filePath.includes('Pipfile')) {
-      i['language'] = PYTHON
-      i['packageManager'] = 'PYPI'
-    }
-    if (i.filePath.includes('csproj')) {
-      i['language'] = DOTNET
-      i['packageManager'] = 'NUGET'
-    }
-    if (i.filePath.includes('Gemfile')) {
-      i['language'] = RUBY
-      i['packageManager'] = 'RUBYGEMS'
-    }
-    if (i.filePath.includes('go.mod')) {
-      i['language'] = GO
-      i['packageManager'] = 'PKG'
-    }
-  })
-  return array
-}
-
-const autoDetectFileAndLanguage = async configToUse => {
-  const entries = await fileFinder.findFile()
-
-  if (entries.length === 1) {
-    console.log(i18n.__('foundScanFile', entries[0]))
-
-    if (hasWhiteSpace(entries[0])) {
-      console.log(i18n.__('fileHasWhiteSpacesError'))
-      process.exit(1)
-    }
-
-    if (fileFinder.fileIsEmpty(entries[0])) {
-      console.log(i18n.__('scanFileIsEmpty'))
-      process.exit(1)
-    }
-
-    configToUse.file = entries[0]
-    if (configToUse.name === undefined) {
-      configToUse.name = entries[0]
-    }
-  } else {
-    errorOnFileDetection(entries)
-  }
-}
-
-const autoDetectAuditFilesAndLanguages = async filePath => {
-  let languagesFound = []
-
-  console.log(i18n.__('searchingAuditFileDirectory', filePath))
-
-  await fileFinder.findFilesJava(languagesFound, filePath)
-  await fileFinder.findFilesJavascript(languagesFound, filePath)
-  await fileFinder.findFilesPython(languagesFound, filePath)
-  await fileFinder.findFilesGo(languagesFound, filePath)
-  await fileFinder.findFilesPhp(languagesFound, filePath)
-  await fileFinder.findFilesRuby(languagesFound, filePath)
-  await fileFinder.findFilesDotNet(languagesFound, filePath)
-
-  if (languagesFound) {
-    return languagesFound
-  }
-
-  return []
-}
-
-const hasWhiteSpace = s => {
-  const filename = s.split('/').pop()
-  return filename.indexOf(' ') >= 0
-}
-
-const dealWithMultiJava = (filesFound, config, isFile) => {
-  if (isFile && filesFound[0] && filesFound[0].language === 'JAVA') {
-    return multiJavaFilePathFullySpecified(filesFound, config)
-  } else {
-    return multiJavaNoFilePathFullySpecified(filesFound)
-  }
-}
-
-const multiJavaNoFilePathFullySpecified = filesFound => {
-  const hasMultiJava =
-    filesFound.filter(
-      data =>
-        Object.keys(data)[0] === JAVA &&
-        Object.values(data)[0].includes('build.gradle') &&
-        Object.values(data)[0].includes('pom.xml')
-    ).length > 0
-
-  if (hasMultiJava) {
-    console.log('Multiple Java language dependency files detected')
-    console.log(
-      'Please use --file to audit one only. \nExample: contrast audit --file pom.xml'
-    )
-    process.exit(1)
-  }
-
-  return filesFound
-}
-
-const multiJavaFilePathFullySpecified = (filesFound, config) => {
-  const filteredFiles = filesFound[0].JAVA.filter(fileTypes =>
-    config.fileName.endsWith(fileTypes)
-  )
-  filesFound[0].JAVA = filteredFiles
-  filesFound[0].filePath = filteredFiles[0]
-
-  if (filteredFiles[0] === 'pom.xml') {
-    filesFound[0].packageManager = 'MAVEN'
-  } else {
-    filesFound[0].packageManager = 'GRADLE'
-  }
-
-  if (config.debug || config.verbose) {
-    console.log('\nAuto detection - detected multiple Java files')
-    console.log(
-      `\nAuto detection - using ${filesFound[0].filePath} as based on full file path`
-    )
-  }
-
-  return filesFound
-}
-
-const errorOnFileDetection = entries => {
-  if (entries.length > 1) {
-    console.log(i18n.__('searchingDirectoryScan'))
-    for (let file in entries) {
-      console.log('-', entries[file])
-    }
-    console.log('')
-    console.log(i18n.__('specifyFileScanError'))
-  } else {
-    console.log(i18n.__('noFileFoundScan'))
-    console.log('')
-    console.log(i18n.__('specifyFileScanError'))
-  }
-  process.exit(1)
-}
-
-const errorOnAuditFileDetection = entries => {
-  if (entries.length > 1) {
-    console.log(i18n.__('searchingDirectoryScan'))
-    for (let file in entries) {
-      console.log('-', entries[file])
-    }
-    console.log('')
-    console.log(i18n.__('specifyFileAuditNotFound'))
-  } else {
-    console.log(i18n.__('noFileFoundScan'))
-    console.log('')
-    console.log(i18n.__('specifyFileAuditNotFound'))
-  }
-}
-
-module.exports = {
-  autoDetectFileAndLanguage,
-  errorOnFileDetection,
-  autoDetectAuditFilesAndLanguages,
-  errorOnAuditFileDetection,
-  autoDetectFingerprintInfo,
-  dealWithMultiJava,
-  detectPackageManager
-}

package/src/common/baseRequest.ts

@@ -1,83 +0,0 @@
-import { HttpsProxyAgent } from 'hpagent'
-import fs from 'fs'
-import got, { Options } from 'got'
-import { Agents, HTTPSOptions } from 'got/dist/source/core'
-
-export function gotInstance(config: any) {
-  return got.extend({ retry: { limit: 0 }, ...buildBaseRequestOptions(config) })
-}
-
-export function buildBaseRequestOptions(config: any) {
-  const { apiKey, authorization } = config
-  const rejectUnauthorized = !config.certSelfSigned
-
-  const superApiKey = config.superApiKey
-  const superAuthToken = config.superAuthorization
-
-  const requestOptions = {
-    responseType: 'json',
-    forever: true,
-    uri: config.host,
-    followRedirect: false,
-    headers: {
-      'Content-Type': 'application/json; charset=utf-8',
-      Authorization: authorization,
-      'API-Key': apiKey,
-      SuperAuthorization: superAuthToken,
-      'Super-API-Key': superApiKey,
-      'User-Agent': 'contrast-cli-v2'
-    },
-    agent: getAgent(config)
-  } as Options
-
-  requestOptions.https = {
-    rejectUnauthorized: rejectUnauthorized
-  }
-
-  maybeAddCertsToRequest(config, requestOptions.https)
-  return requestOptions
-}
-
-function getAgent(config: any) {
-  return config.proxy
-    ? (new HttpsProxyAgent({ proxy: config.proxy }) as Agents)
-    : false
-}
-
-function maybeAddCertsToRequest(config: any, https: HTTPSOptions) {
-  // cacert
-  const caCertFilePath = config.cacert
-  if (caCertFilePath) {
-    try {
-      https.certificateAuthority = fs.readFileSync(caCertFilePath)
-    } catch (error: any) {
-      throw new Error(
-        `Unable to read CA from ${caCertFilePath}, msg: ${error.message}`
-      )
-    }
-  }
-
-  // cert
-  const certPath = config.cert
-  if (certPath) {
-    try {
-      https.certificate = fs.readFileSync(certPath)
-    } catch (error: any) {
-      throw new Error(
-        `Unable to read Certificate PEM file from config option contrast.api.certificate.cert_file='${certPath}', msg: ${error.message}`
-      )
-    }
-  }
-
-  // key
-  const keyPath = config.key
-  if (keyPath) {
-    try {
-      https.key = fs.readFileSync(keyPath)
-    } catch (error: any) {
-      throw new Error(
-        `Unable to read Key PEM file from config option contrast.api.certificate.key_file='${keyPath}', msg: ${error.message}`
-      )
-    }
-  }
-}

package/src/common/commonHelp.js

@@ -1,53 +0,0 @@
-const i18n = require('i18n')
-const chalk = require('chalk')
-
-const commonHelpLinks = () => {
-  return [
-    {
-      header: i18n.__('commonHelpHeader'),
-      content: [
-        i18n.__('commonHelpCheckOutHeader') + i18n.__('commonHelpCheckOutText'),
-        i18n.__('commonHelpLearnMoreHeader') +
-          i18n.__('commonHelpLearnMoreText'),
-        i18n.__('commonHelpJoinDiscussionHeader') +
-          i18n.__('commonHelpJoinDiscussionText')
-      ]
-    },
-    {
-      header: i18n.__('commonHelpEnterpriseHeader'),
-      content: [
-        i18n.__('commonHelpLearnMoreEnterpriseHeader') +
-          i18n.__('commonHelpLearnMoreEnterpriseText')
-      ]
-    },
-    {
-      content: [
-        i18n.__('commonHelpLearnHeader') + i18n.__('commonHelpLearnText')
-      ]
-    }
-  ]
-}
-
-const postRunMessage = commandName => {
-  console.log('\n' + chalk.underline.bold('Other Features:'))
-  if (commandName !== 'scan')
-    console.log(
-      "'contrast scan' to run Contrast's industry leading SAST scanner"
-    )
-  if (commandName !== 'audit')
-    console.log(
-      "'contrast audit' to find vulnerabilities in your open source dependencies"
-    )
-  if (commandName !== 'lambda')
-    console.log("'contrast lambda' to secure your AWS serverless functions")
-
-  if (commandName !== 'learn')
-    console.log(
-      "'contrast learn' launches Contrast's Secure Code Learning Hub."
-    )
-}
-
-module.exports = {
-  commonHelpLinks,
-  postRunMessage
-}

package/src/common/errorHandling.js

@@ -1,157 +0,0 @@
-const i18n = require('i18n')
-const chalk = require('chalk')
-
-const libraryAnalysisError = () => {
-  console.log(i18n.__('libraryAnalysisError'))
-}
-
-const snapshotFailureError = () => {
-  console.log(i18n.__('snapshotFailureMessage'))
-}
-
-const vulnerabilitiesFailureError = () => {
-  console.log(i18n.__('vulnerabilitiesFailureMessage'))
-}
-
-const reportFailureError = () => {
-  console.log(i18n.__('auditReportFailureMessage'))
-}
-
-const genericError = () => {
-  console.error(i18n.__('genericErrorMessage'))
-  process.exit(1)
-}
-
-const unauthenticatedError = () => {
-  generalError('unauthenticatedErrorHeader', 'unauthenticatedErrorMessage')
-}
-
-const badRequestError = catalogue => {
-  catalogue === true
-    ? generalError('badRequestErrorHeader', 'badRequestCatalogueErrorMessage')
-    : generalError('badRequestErrorHeader', 'badRequestErrorMessage')
-}
-
-const forbiddenError = () => {
-  generalError('forbiddenRequestErrorHeader', 'forbiddenRequestErrorMessage')
-  process.exit(1)
-}
-
-const proxyError = () => {
-  generalError('proxyErrorHeader', 'proxyErrorMessage')
-}
-
-const maxAppError = () => {
-  generalError(
-    'No applications remaining',
-    'You have reached the maximum number of application you can create.'
-  )
-  process.exit(1)
-}
-
-const parametersError = () => {
-  generalError(
-    `Credentials not recognized`,
-    'Check your command & keys again for hidden characters / verify that the credentials are correct.\nFor more information use contrast help.'
-  )
-  process.exit(1)
-}
-
-const invalidHostNameError = () => {
-  generalError(
-    `Invalid host`,
-    'Check that the host parameter does not include a trailing "/".'
-  )
-  process.exit(1)
-}
-
-const failOptionError = () => {
-  console.log(
-    '\n ******************************** ' +
-      i18n.__('snapshotFailureHeader') +
-      ' ********************************\n' +
-      i18n.__('failOptionErrorMessage')
-  )
-}
-
-/**
- * You don't have to pass `i18n` translation.
- * String that didn't exists on translations will pass as regular string
- * @param header title for the error
- * @param message message for the error
- * @returns error in general format
- */
-const getErrorMessage = (header, message) => {
-  // prettier-ignore
-  const title = `******************************** ${i18n.__(header)} ********************************`
-  const multiLine = message?.includes('\n')
-  let finalMessage = ''
-
-  // i18n split the line if it includes '\n'
-  if (multiLine) {
-    finalMessage = `\n${message}`
-  } else if (message) {
-    finalMessage = `\n${i18n.__(message)}`
-  }
-
-  return `${title}${finalMessage}`
-}
-
-const generalError = (header, message) => {
-  const finalMessage = getErrorMessage(header, message)
-  console.log(finalMessage)
-}
-
-const findCommandOnError = unknownOptions => {
-  const commandKeywords = {
-    auth: 'auth',
-    audit: 'audit',
-    scan: 'scan',
-    lambda: 'lambda',
-    config: 'config'
-  }
-
-  const containsCommandKeyword = unknownOptions.some(
-    command => commandKeywords[command]
-  )
-
-  if (containsCommandKeyword) {
-    const foundCommands = unknownOptions.filter(
-      command => commandKeywords[command]
-    )
-
-    //return the first command found
-    return foundCommands[0]
-  }
-}
-
-const commonMessageFormatter = (message, fail) => {
-  console.log(chalk.bold(i18n.__(message.title)))
-  console.log(i18n.__(message.body))
-  if (message.extra) {
-    console.log(i18n.__(message.extra))
-  }
-  if (fail) {
-    process.exit(1)
-  }
-}
-
-module.exports = {
-  genericError,
-  unauthenticatedError,
-  badRequestError,
-  forbiddenError,
-  proxyError,
-  failOptionError,
-  generalError,
-  getErrorMessage,
-  libraryAnalysisError,
-  findCommandOnError,
-  snapshotFailureError,
-  vulnerabilitiesFailureError,
-  reportFailureError,
-  maxAppError,
-  parametersError,
-  invalidHostNameError,
-  commonMessageFormatter
-}

package/src/common/fail.js

@@ -1,79 +0,0 @@
-const i18n = require('i18n')
-
-const processFail = (config, reportResults) => {
-  if (config.severity !== undefined) {
-    if (
-      reportResults[config.severity] !== undefined &&
-      isSeverityViolation(config.severity, reportResults)
-    ) {
-      failPipeline('failSeverityOptionErrorMessage')
-    }
-  }
-
-  if (config.severity === undefined && reportResults.total > 0) {
-    failPipeline('failThresholdOptionErrorMessage')
-  }
-}
-
-const isSeverityViolation = (severity, reportResults) => {
-  let count = 0
-  switch (severity) {
-    case 'critical':
-      count += reportResults.critical
-      break
-    case 'high':
-      count += reportResults.high + reportResults.critical
-      break
-    case 'medium':
-      count +=
-        reportResults.medium + reportResults.high + reportResults.critical
-      break
-    case 'low':
-      count +=
-        reportResults.high +
-        reportResults.critical +
-        reportResults.medium +
-        reportResults.low
-      break
-    case 'note':
-      if (reportResults.note == reportResults.total) {
-        count = 0
-      } else {
-        count = reportResults.total
-      }
-      break
-    default:
-      count = 0
-  }
-  return count > 0
-}
-
-const failPipeline = (message = '') => {
-  console.log(
-    '\n ******************************** ' +
-      i18n.__('snapshotFailureHeader') +
-      ' *********************************\n' +
-      i18n.__(message)
-  )
-  process.exit(2)
-}
-
-const parseSeverity = severity => {
-  const severities = ['NOTE', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL']
-  if (severities.includes(severity.toUpperCase())) {
-    return severity.toLowerCase()
-  } else {
-    console.log(
-      severity +
-        ' Not recognised as a severity type please use LOW, MEDIUM, HIGH, CRITICAL, NOTE'
-    )
-    return undefined
-  }
-}
-
-module.exports = {
-  failPipeline,
-  processFail,
-  isSeverityViolation,
-  parseSeverity
-}

package/src/common/versionChecker.js

@@ -1,75 +0,0 @@
-const { APP_VERSION } = require('../constants/constants')
-const boxen = require('boxen')
-const chalk = require('chalk')
-const semver = require('semver')
-const commonApi = require('../utils/commonApi')
-const { constants } = require('http2')
-
-const getLatestVersion = async config => {
-  const client = commonApi.getHttpClient(config)
-  try {
-    const res = await client.getLatestVersion()
-    if (res.statusCode === constants.HTTP_STATUS_OK) {
-      return res.body
-    }
-  } catch (e) {
-    return undefined
-  }
-}
-
-const findLatestCLIVersion = async config => {
-  const isCI = process.env.CONTRAST_CODESEC_CI
-    ? JSON.parse(process.env.CONTRAST_CODESEC_CI.toLowerCase())
-    : false
-
-  if (!isCI) {
-    let latestCLIVersion = await getLatestVersion(config)
-
-    if (latestCLIVersion === undefined) {
-      config.set('numOfRuns', 0)
-      console.log(
-        'Failed to retrieve latest version info. Continuing execution.'
-      )
-      return
-    }
-
-    //strip key and remove new lines
-    latestCLIVersion = latestCLIVersion.substring(8).replace('\n', '')
-
-    if (semver.lt(APP_VERSION, latestCLIVersion)) {
-      const updateAvailableMessage = `Update available ${chalk.yellow(
-        APP_VERSION
-      )} → ${chalk.green(latestCLIVersion)}`
-
-      const npmUpdateAvailableCommand = `Run ${chalk.cyan(
-        'npm i @contrast/contrast -g'
-      )} to update via npm`
-
-      const homebrewUpdateAvailableCommand = `Run ${chalk.cyan(
-        'brew install contrastsecurity/tap/contrast'
-      )} to update via brew`
-
-      console.log(
-        boxen(
-          `${updateAvailableMessage}\n${npmUpdateAvailableCommand}\n\n${homebrewUpdateAvailableCommand}`,
-          {
-            titleAlignment: 'center',
-            margin: 1,
-            padding: 1,
-            align: 'center'
-          }
-        )
-      )
-    }
-  }
-}
-
-const isCorrectNodeVersion = async currentVersion => {
-  return semver.satisfies(currentVersion, '>=16')
-}
-
-module.exports = {
-  getLatestVersion,
-  findLatestCLIVersion,
-  isCorrectNodeVersion
-}