@contrast/contrast 2.1.6 → 2.1.7

package/dist/cliConstants.js

@@ -514,6 +514,7 @@ const mainUsageGuide = commandLineUsage([
             { name: i18n.__('lambdaName'), summary: i18n.__('helpLambdaSummary') },
             { name: i18n.__('helpName'), summary: i18n.__('helpSummary') },
             { name: i18n.__('learnName'), summary: i18n.__('helpLearnSummary') },
+            // { name: i18n.__('sarifName'), summary: i18n.__('sarifSummary') },
             {
                 name: i18n.__('configGenerate'),
                 summary: i18n.__('configGenerateSummary')

package/dist/common/baseRequest.js

@@ -108,4 +108,5 @@ export var ErrorType;
     ErrorType["VULNERABILITIES"] = "VULNERABILITIES";
     ErrorType["SCAN"] = "SCAN";
     ErrorType["TELEMETRY"] = "TELEMETRY";
+    ErrorType["SARIF"] = "SARIF";
 })(ErrorType || (ErrorType = {}));

package/dist/constants/constants.js

@@ -17,7 +17,7 @@ export const HIGH = 'HIGH';
 export const CRITICAL = 'CRITICAL';
 // App
 export const APP_NAME = 'contrast';
-const APP_VERSION = '2.1.6';
+const APP_VERSION = '2.1.7';
 export const TIMEOUT = 120000;
 export const CRITICAL_PRIORITY = 1;
 export const HIGH_PRIORITY = 2;

package/dist/constants/locales.js

@@ -126,6 +126,7 @@ export const en_locales = () => {
         configName: 'config',
         helpName: 'help',
         learnName: 'learn',
+        sarifName: 'sarif',
         configGenerate: 'generate-config',
         helpLearnSummary: 'Launches Contrast’s Secure Code Learning Hub.',
         configGenerateSummary: 'Generates contrast configuration yaml file.',

package/dist/index.js

@@ -14,6 +14,7 @@ import { processLearn } from './commands/learn/processLearn.js';
 import { sendTelemetryConfigAsConfObj } from './telemetry/telemetry.js';
 import { findCommandOnError } from './common/errorHandling.js';
 import { processAssess } from './assess/index.js';
+import { processSarif } from './sarif/generateSarif.js';
 import { logInfo } from './common/logging.js';
 import { generateYamlConfiguration } from './generateYaml/index.js';
 const config = localConfig(APP_NAME, getAppVersion());
@@ -70,15 +71,15 @@ const start = async () => {
             if (command === 'assess') {
                 return await processAssess(config, argvMain);
             }
-            if (command === 'assess') {
-                return await processAssess(config, argvMain);
-            }
             if (command === 'generate-config') {
                 return await generateYamlConfiguration(config, argvMain);
             }
             if (command === 'fingerprint') {
                 return await processFingerprint(config, argvMain);
             }
+            if (command === 'sarif') {
+                return processSarif(config, argvMain);
+            }
             if (command === 'learn') {
                 return processLearn();
             }

package/dist/sarif/generateSarif.js

@@ -0,0 +1,17 @@
+import { getAuditConfig } from '../audit/auditConfig.js';
+import { scaCVES } from './sarifScaClient.js';
+import { iastData } from './sarifIastClient.js';
+import { writeCombinedSarif } from './sarifWriter.js';
+// This filename could be set by a customer
+// Defaulted to be ingested in a GH workflow
+const outputFileName = 'contrast.sarif.json';
+export const processSarif = async (contrastConf, argvMain) => {
+    console.log('Generating SARIF export');
+    let config = await getAuditConfig(contrastConf, 'audit', argvMain);
+    const scaVulns = await scaCVES(config);
+    console.log(`Found ${scaVulns.length} SCA vulnerabilities`);
+    const iastVulns = await iastData(config);
+    console.log(`Found ${iastVulns.length} IAST vulnerabilities`);
+    writeCombinedSarif(iastVulns, scaVulns, outputFileName);
+    console.log('SARIF generated');
+};

package/dist/sarif/sarifAssessRequests.js

@@ -0,0 +1,39 @@
+import { buildBaseRequestOptions, ErrorType } from '../common/baseRequest.js';
+import { got } from 'got';
+const getAssessTraceIdsUrl = (config, offset, resultsLimit) => {
+    return `${config.host}/Contrast/api/ng/${config.organizationId}/orgtraces/filter/?offset=${offset}&limit=${resultsLimit}`;
+};
+export function getAssessTraceIds(config, offset, resultsLimit) {
+    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
+    options.url = getAssessTraceIdsUrl(config, offset, resultsLimit);
+    options.json = {
+        applicationID: config.applicationId,
+        // metadataFilters: sessionMetadata,
+        severities: [config.severity]
+    };
+    return got.post(options);
+}
+const getAssessTraceDetailsUrl = (config, traceId) => {
+    return `${config.host}/Contrast/api/ng/${config.organizationId}/traces/${config.applicationId}/filter/${traceId}?expand=events,request,sink,${traceId},skip_links`;
+};
+export function getAssessTraceDetails(config, traceId) {
+    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
+    options.url = getAssessTraceDetailsUrl(config, traceId);
+    return got.get(options);
+}
+const getAssessTraceEventsUrl = (config, traceId, eventId) => {
+    return `${config.host}/Contrast/api/ng/${config.organizationId}/traces/${traceId}/events/${eventId}/details`;
+};
+export function getAssessTraceEvents(config, traceId, eventId) {
+    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
+    options.url = getAssessTraceEventsUrl(config, traceId, eventId);
+    return got.get(options);
+}
+const getAssessTraceRoutesUrl = (config, traceId) => {
+    return `${config.host}/Contrast/api/ng/${config.organizationId}/traces/${config.applicationId}/trace/${traceId}/routes`;
+};
+export function getAssessTraceRoutes(config, traceId) {
+    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
+    options.url = getAssessTraceRoutesUrl(config, traceId);
+    return got.get(options);
+}

package/dist/sarif/sarifIastClient.js

@@ -0,0 +1,65 @@
+import { getAssessTraceDetails, getAssessTraceEvents, getAssessTraceIds, getAssessTraceRoutes } from './sarifAssessRequests.js';
+const resultsLimit = 50;
+let offset = 0;
+export const iastData = async (config) => {
+    const filteredTraceIds = await getTraceIds(config, offset, resultsLimit);
+    console.log(`Found ${filteredTraceIds.length} traces`);
+    let completeTraces = [];
+    for (const traceId of filteredTraceIds) {
+        const traceDetails = await getTraceDetails(config, traceId);
+        const traceRoutes = await getTraceRoutes(config, traceId);
+        let eventsWithFrames = [];
+        if (traceDetails.events) {
+            for (const eventSummary of traceDetails.events) {
+                const eventDetails = await getTraceEvents(config, traceId, eventSummary.eventId);
+                eventsWithFrames.push(eventDetails);
+            }
+        }
+        completeTraces.push({
+            trace: traceDetails,
+            events: eventsWithFrames,
+            routes: traceRoutes
+        });
+    }
+    return completeTraces;
+};
+export async function getTraceIds(config, offset, resultsLimit) {
+    let hasResults = true;
+    let pivotedData = [];
+    while (hasResults) {
+        const response = getAssessTraceIds(config, offset, resultsLimit);
+        const responseBody = await response.json();
+        if (responseBody.traces == null) {
+            console.log('No libraries found');
+            return pivotedData;
+        }
+        const result = responseBody.traces;
+        const traceIds = result.map(trace => {
+            return trace.uuid;
+        });
+        pivotedData = pivotedData.concat(traceIds);
+        if (result.length < resultsLimit) {
+            hasResults = false;
+        }
+        offset += resultsLimit;
+    }
+    return pivotedData;
+}
+export async function getTraceDetails(config, traceId) {
+    console.log(`Getting trace details for ${traceId} of application ${config.applicationId}`);
+    const response = getAssessTraceDetails(config, traceId);
+    const responseBody = await response.json();
+    return responseBody.trace;
+}
+export async function getTraceEvents(config, traceId, eventId) {
+    const response = getAssessTraceEvents(config, traceId, eventId);
+    console.log(`Getting trace events for ${eventId} of trace ${traceId}`);
+    const responseBody = await response.json();
+    return responseBody.event;
+}
+export async function getTraceRoutes(config, traceId) {
+    console.log(`Getting trace route for ${traceId} of application ${config.applicationId}`);
+    const response = getAssessTraceRoutes(config, traceId);
+    const responseBody = await response.json();
+    return responseBody.routes;
+}

package/dist/sarif/sarifSCARequests.js

@@ -0,0 +1,25 @@
+import { buildBaseRequestOptions, ErrorType } from '../common/baseRequest.js';
+import { got } from 'got';
+const getSCAVulnsUrl = (config, offset, resultsLimit) => {
+    return `${config.host}/Contrast/api/ng/${config.organizationId}/libraries/filter?expand=skip_links,apps,quickFilters,vulns,status,usage_counts&offset=${offset}&limit=${resultsLimit}&sort=score`;
+};
+export function getSCAVulns(config, offset, resultsLimit) {
+    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
+    options.url = getSCAVulnsUrl(config, offset, resultsLimit);
+    options.json = {
+        q: '',
+        quickFilter: 'VULNERABLE',
+        apps: [config.applicationId],
+        servers: [],
+        environments: [],
+        grades: [],
+        languages: [],
+        licenses: [],
+        status: [],
+        severities: [config.severity],
+        tags: [],
+        includeUnused: false,
+        includeUsed: false
+    };
+    return got.post(options);
+}

package/dist/sarif/sarifScaClient.js

@@ -0,0 +1,35 @@
+import { getSCAVulns } from './sarifSCARequests.js';
+const resultsLimit = 50;
+let offset = 0;
+export const scaCVES = async (config) => {
+    let hasResults = true;
+    let pivotedData = [];
+    while (hasResults) {
+        const response = getSCAVulns(config, offset, resultsLimit);
+        const responseBody = await response.json();
+        if (responseBody.libraries == null) {
+            console.log('No libraries found');
+            return pivotedData;
+        }
+        // Finds all libraries with a vulnerability of specified severity
+        const result = responseBody.libraries.flatMap(item => {
+            const { vulns } = item;
+            return vulns.flatMap(vuln => {
+                vuln.library = item;
+                return vuln;
+            });
+        });
+        // All vulns associated with the library will be returned,
+        // so we must filter by severity again
+        for (const vuln of result) {
+            if (vuln.severityToUse.toLowerCase() === config.severity) {
+                pivotedData.push(vuln);
+            }
+        }
+        if (result.length < resultsLimit) {
+            hasResults = false;
+        }
+        offset += resultsLimit;
+    }
+    return pivotedData;
+};

package/dist/sarif/sarifWriter.js

@@ -0,0 +1,156 @@
+import { SarifBuilder, SarifRunBuilder, SarifResultBuilder } from 'node-sarif-builder';
+import fs from 'fs';
+export const mapSeverity = contrastSeverity => {
+    switch (contrastSeverity.toLowerCase()) {
+        case 'critical':
+            return 'error';
+        case 'high':
+            return 'warning';
+        case 'medium':
+            return 'note';
+        case 'low':
+            return 'note';
+        case 'note':
+            return 'note';
+        default:
+            return 'note';
+    }
+};
+export const getFileFromTSDescription = description => {
+    const regex = /\(([^)]+):\d*\)/;
+    const match = regex.exec(description);
+    return match ? match[1] : 'NOT AVAILABLE';
+};
+export const getLineFromTSDescription = description => {
+    const regex = /\(.*:(\d*)\)/;
+    const match = regex.exec(description);
+    return match ? parseInt(match[1]) : 0;
+};
+export const getLogicalLocationFromTSDescription = description => {
+    const regex = /(.*)\([^]+:\d*\)/;
+    const match = regex.exec(description);
+    return match ? match[1] + '()' : 'NOT AVAILABLE';
+};
+export const generateIastSarifRun = traces => {
+    const sarifRunBuilderIast = new SarifRunBuilder().initSimple({
+        toolDriverName: 'contrast-assess',
+        toolDriverVersion: '1.0.0',
+        url: 'https://contrastsecurity.com' // Url of your analyzer tool
+    });
+    if (traces.length === 0) {
+        return sarifRunBuilderIast;
+    }
+    for (const trace of traces) {
+        let extractedString = null;
+        if (trace.sink && trace.sink.label) {
+            extractedString = getFileFromTSDescription(trace.sink.label);
+        }
+        const sarifResultBuilder = new SarifResultBuilder().initSimple({
+            ruleId: trace.trace.rule_title,
+            messageText: trace.trace.title,
+            level: mapSeverity(trace.trace.severity)
+        });
+        if (extractedString) {
+            sarifResultBuilder.setLocationArtifactUri({ uri: extractedString });
+        }
+        if (trace.trace.request) {
+            sarifResultBuilder.result.webRequest = {
+                target: trace.trace.request.uri,
+                method: trace.trace.request.method,
+                protocol: trace.trace.request.protocol,
+                version: trace.trace.request.version
+            };
+        }
+        sarifResultBuilder.result.provenance = {
+            firstDetectionTimeUtc: new Date(trace.trace.discovered).toISOString(),
+            lastDetectionTimeUtc: new Date(trace.trace.last_time_seen).toISOString()
+        };
+        sarifResultBuilder.result.properties = {
+            vulnerability_id: trace.trace.uuid,
+            contrast_severity: trace.trace.severity,
+            contrast_status: trace.trace.status,
+            contrast_substatus: trace.trace.sub_status
+        };
+        // Add stack trace
+        sarifResultBuilder.result.codeFlows = [
+            {
+                threadFlows: trace.events.map(event => {
+                    return {
+                        locations: [
+                            {
+                                stack: {
+                                    frames: event.stacktraces.map(stacktrace => {
+                                        return {
+                                            location: {
+                                                physicalLocation: {
+                                                    artifactLocation: {
+                                                        uri: getFileFromTSDescription(stacktrace.description)
+                                                    },
+                                                    region: {
+                                                        startLine: getLineFromTSDescription(stacktrace.description)
+                                                    }
+                                                },
+                                                logicalLocations: [
+                                                    {
+                                                        fullyQualifiedName: getLogicalLocationFromTSDescription(stacktrace.description)
+                                                    }
+                                                ]
+                                            }
+                                        };
+                                    })
+                                }
+                            }
+                        ]
+                    };
+                }),
+                properties: {
+                    routeSignature: trace.routes[0] ? trace.routes[0].signature : ''
+                }
+            }
+        ];
+        sarifRunBuilderIast.addResult(sarifResultBuilder);
+    }
+    return sarifRunBuilderIast;
+};
+export const generateScaSarifRun = cveList => {
+    const sarifRunBuilderSca = new SarifRunBuilder().initSimple({
+        toolDriverName: 'contrast-sca',
+        toolDriverVersion: '1.0.0',
+        url: 'https://contrastsecurity.com' // Url of your analyzer tool
+    });
+    if (cveList.length === 0) {
+        return sarifRunBuilderSca;
+    }
+    for (const cve of cveList) {
+        const sarifResultBuilder = new SarifResultBuilder().initSimple({
+            ruleId: cve.name,
+            messageText: cve.description,
+            level: mapSeverity(cve.severityToUse)
+        });
+        sarifResultBuilder.setLocationArtifactUri({ uri: cve.library.file_name });
+        sarifResultBuilder.result.properties = {
+            contrast_severity: cve.severityToUse,
+            library_version: cve.library.version,
+            cvss_score: cve.cvss_3_severity_value,
+            vector: cve.cvss_3_vector
+        };
+        sarifRunBuilderSca.addResult(sarifResultBuilder);
+    }
+    return sarifRunBuilderSca;
+};
+export const writeCombinedSarif = (traces, cveList, output) => {
+    const sarifBuilder = new SarifBuilder();
+    const sarifRunBuilderIast = generateIastSarifRun(traces);
+    sarifBuilder.addRun(sarifRunBuilderIast);
+    const sarifRunBuilderSca = generateScaSarifRun(cveList);
+    sarifBuilder.addRun(sarifRunBuilderSca);
+    const sarifJsonString = sarifBuilder.buildSarifJsonString({
+        indent: true
+    }); // indent:true if you like
+    if (output) {
+        fs.writeFileSync(output, sarifJsonString);
+    }
+    else {
+        console.log(sarifJsonString);
+    }
+};

package/dist/scaAnalysis/common/scaServicesUpload.js

@@ -78,6 +78,15 @@ export const noProjectUpload = async (analysis, config, reportSpinner) => {
             doPoll = false;
             const reportRes = await scaServiceReportNoProject(config, reportID);
             const reportBody = reportRes.body;
+            for (let x in reportBody) {
+                let dateTime = new Date();
+                if (reportBody[x].vulnerabilities.length === 0) {
+                    logDebug(config, `${dateTime.toISOString()} Unable to find vulnerabilities for ${reportBody[x].groupName}:${reportBody[x].artifactName}, ${reportBody[x].version}, ${reportBody[x].hash}.  Environment: ${config.host}, OrgId: ${config.organizationId}, AppId: ${config.applicationId}`);
+                }
+                if (reportBody[x].remediationAdvice === null) {
+                    logDebug(config, `${dateTime.toISOString()} unable to find remediation advice for ${reportBody[x].groupName}:${reportBody[x].artifactName}, ${reportBody[x].version}, ${reportBody[x].hash}. Environment: ${config.host}, OrgId: ${config.organizationId}, AppId: ${config.applicationId}`);
+                }
+            }
             if (config.saveResults !== undefined) {
                 fs.writeFileSync('audit-results.json', JSON.stringify(reportBody));
             }

package/dist/scaAnalysis/java/analysis.js

@@ -7,8 +7,11 @@ import { logDebug } from '../../common/logging.js';
 import { GO, GRADLE, MAVEN, NODE, YARN } from '../../constants/constants.js';
 export const determineProjectTypeAndCwd = (files, packageManager, config) => {
     const projectData = {};
+    //clean up the path to be a folder not a file
+    projectData.cwd = config.file ? replacePathing(config) : config.file;
     if (isMaven(files, packageManager)) {
         projectData.projectType = MAVEN;
+        calculateMavenCommand(projectData);
     }
     else if (isGradle(files, packageManager)) {
         projectData.projectType = GRADLE;
@@ -46,7 +49,7 @@ const replacePathing = config => config.file
     .replace('build.gradle', '')
     .replace('build.gradle.kts', '');
 const buildMaven = (config, projectData, timeout) => {
-    let command = 'mvn';
+    let command = projectData.mvnCommand;
     let args = ['dependency:tree', '-B', '-Dscope=runtime'];
     if (config.mavenSettingsPath) {
         args.push('-s');
@@ -61,6 +64,17 @@ const buildMaven = (config, projectData, timeout) => {
     checkForErrors(cmdDepTree, config);
     return cmdDepTree.stdout.toString();
 };
+export const calculateMavenCommand = projectData => {
+    if (fs.existsSync(projectData.cwd + '/mvnw')) {
+        projectData.mvnCommand = projectData.cwd + '/mvnw';
+        if (process.platform === 'win32') {
+            projectData.mvnCommand += '.cmd';
+        }
+    }
+    else {
+        projectData.mvnCommand = 'mvn';
+    }
+};
 export function checkForErrors(cmdDepTree, config) {
     checkMavenExists(cmdDepTree, config);
     if (cmdDepTree.error || cmdDepTree.status !== 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/contrast",
-  "version": "2.1.6",
+  "version": "2.1.7",
   "description": "Contrast Security's command line tool",
   "exports": "./dist/index.js",
   "type": "module",
@@ -77,14 +77,15 @@
     "js-yaml": "4.1.0",
     "lodash-es": "4.17.21",
     "log-symbols": "4.1.0",
+    "node-sarif-builder": "^3.1.0",
     "open": "8.4.2",
     "ora": "6.3.1",
+    "pkginfo": "0.4.1",
     "semver": "7.5.4",
     "string-builder": "0.1.8",
     "string-multiple-replace": "1.0.5",
     "xml2js": "0.6.1",
-    "yarn-lockfile": "1.1.1",
-    "pkginfo": "0.4.1"
+    "yarn-lockfile": "1.1.1"
   },
   "devDependencies": {
     "@babel/core": "7.21.8",