@contrast/contrast 2.1.7 → 2.3.0

package/dist/cliConstants.js

@@ -343,6 +343,52 @@ const auditAdvancedOptionDefinitionsForHelp = [
             i18n.__('constantsMavenSettingsPath')
     }
 ];
+const sarifAdvancedOptionDefinitionsForHelp = [
+    ...sharedConnectionOptionDefinitions,
+    ...sharedCertOptionDefinitions
+];
+const sarifOptionDefinitions = [
+    ...sarifAdvancedOptionDefinitionsForHelp,
+    {
+        name: 'help',
+        alias: 'h',
+        type: Boolean
+    },
+    {
+        name: 'application-id',
+        description: '{bold ' +
+            i18n.__('constantsRequired') +
+            '}: ' +
+            i18n.__('constantsApplicationId')
+    },
+    {
+        name: 'metadata',
+        description: '{bold ' +
+            i18n.__('constantsOptional') +
+            '}: ' +
+            i18n.__('constantsMetadata')
+    },
+    {
+        name: 'severity',
+        type: severity => parseSeverity(severity),
+        description: '{bold ' +
+            i18n.__('constantsOptional') +
+            '}: ' +
+            i18n.__('constantsSarifSeverity')
+    },
+    {
+        name: 'tool-type',
+        description: '{bold ' +
+            i18n.__('constantsOptional') +
+            '}: ' +
+            i18n.__('constantsToolType')
+    },
+    {
+        name: 'debug',
+        alias: 'd',
+        type: Boolean
+    }
+];
 const auditOptionDefinitions = [
     ...auditAdvancedOptionDefinitionsForHelp,
     {
@@ -509,12 +555,13 @@ const mainUsageGuide = commandLineUsage([
             { name: i18n.__('configName'), summary: i18n.__('helpConfigSummary') },
             { name: i18n.__('versionName'), summary: i18n.__('helpVersionSummary') },
             { name: i18n.__('auditName'), summary: i18n.__('helpAuditSummary') },
+            { name: i18n.__('sarifName'), summary: i18n.__('helpSarifSummary') },
             { name: i18n.__('scanName'), summary: i18n.__('helpScanSummary') },
             { name: i18n.__('assessName'), summary: i18n.__('assessSummary') },
             { name: i18n.__('lambdaName'), summary: i18n.__('helpLambdaSummary') },
             { name: i18n.__('helpName'), summary: i18n.__('helpSummary') },
             { name: i18n.__('learnName'), summary: i18n.__('helpLearnSummary') },
-            // { name: i18n.__('sarifName'), summary: i18n.__('sarifSummary') },
+            { name: i18n.__('sarifName'), summary: i18n.__('sarifSummary') },
             {
                 name: i18n.__('configGenerate'),
                 summary: i18n.__('configGenerateSummary')
@@ -544,6 +591,8 @@ export const commandLineDefinitions = {
     auditOptionDefinitions,
     authOptionDefinitions,
     configOptionDefinitions,
+    sarifOptionDefinitions,
+    sarifAdvancedOptionDefinitionsForHelp,
     scanAdvancedOptionDefinitionsForHelp,
     auditAdvancedOptionDefinitionsForHelp,
     assessOptionDefinitions,

package/dist/constants/constants.js

@@ -17,7 +17,7 @@ export const HIGH = 'HIGH';
 export const CRITICAL = 'CRITICAL';
 // App
 export const APP_NAME = 'contrast';
-const APP_VERSION = '2.1.7';
+const APP_VERSION = '2.3.0';
 export const TIMEOUT = 120000;
 export const CRITICAL_PRIORITY = 1;
 export const HIGH_PRIORITY = 2;

package/dist/constants/locales.js

@@ -52,6 +52,7 @@ export const en_locales = () => {
         failThresholdOptionErrorMessage: 'More than 0 vulnerabilities found',
         failSeverityOptionErrorMessage: ' FAIL - Results detected vulnerabilities over accepted severity level',
         constantsSeverity: 'Use with "contrast scan --fail --severity high" or "contrast audit --fail --severity high". Set the severity level to detect vulnerabilities or dependencies. Severity levels are critical, high, medium, low or note.',
+        constantsSarifSeverity: 'Set the severity level to filter the vulnerabilities included in the SARIF output. Severity levels are critical, high, medium, low or note.',
         constantsHeader: `Contrast CLI @ v${getAppVersion()}`,
         configHeader2: 'Config options',
         clearHeader: '-c, --clear',
@@ -67,6 +68,8 @@ export const en_locales = () => {
         constantsConfigUsageContents: 'view / clear the configuration',
         constantsPrerequisitesContent: 'To scan a Java binary project you will need a .jar, .war or a zip of multiple .jar or .war files for analysis\n' +
             'To scan source code you will need a .zip file containing the code for analysis',
+        constantsSarifPreRequisitesContent: 'To generate a SARIF file you will need the application-id of the application you want to generate the SARIF file for.\n' +
+            'To get the application-id, go to the Contrast UI, select the application you want to generate the SARIF file for, and copy the application-id from the URL.',
         constantsUsage: 'Usage',
         constantsUsageCommandExample: 'contrast [command] [options]',
         constantsUsageCommandInfo: 'The file argument is optional. If no file is given, Contrast will search for a .jar, .war, .exe or .zip file in the working directory.\n',
@@ -90,6 +93,7 @@ export const en_locales = () => {
         scanLabel: "adds a label to the scan - defaults to 'Started by CLI tool at current date'",
         constantsIgnoreDev: 'Excludes developer dependencies from the results. All dependencies are included by default.',
         constantsCommands: 'Commands',
+        constantsSarifOptions: 'SARIF Options',
         constantsScanOptions: 'Scan Options',
         constantsAssessOptions: 'Assess Options',
         generatorConfigOptions: 'Generate Config Options',
@@ -114,6 +118,7 @@ export const en_locales = () => {
         helpScanSummary: 'Searches for a .jar, .war, .js, or .zip file in the working directory, uploads files for analysis, and returns the results. \n[scan --help for options] Java, .NET, .NET Core, JavaScript are supported. ',
         assessSummary: 'Reports vulnerabilities found at run-time on a server or microservice using a Contrast agent. \n [assess --help for options] Java, .NET, Node, Ruby, Python, Go, PHP are supported.',
         helpLambdaSummary: 'Performs a static security scan on an AWS lambda function. [lambda --help for options] AWS Lambda - Java & Python are supported. ',
+        helpSarifSummary: 'Generates a SARIF file (contrast.sarif) for Contrast Assess and Contrast SCA results for the specified application-id.',
         helpVersionSummary: 'Displays version of Contrast CLI',
         helpConfigSummary: 'Displays stored credentials',
         helpSummary: 'Displays usage guide',
@@ -171,6 +176,8 @@ export const en_locales = () => {
         foundDetailedVulnerabilities: chalk.bold('%s') + ' | ' + chalk.bold('%s') + ' | %s | %s | %s ',
         searchingScanFileDirectory: 'Searching for file to scan from %s...',
         searchingAuditFileDirectory: 'Searching for package manager files from %s...',
+        sarifHeader: 'Contrast SARIF CLI',
+        sarifHeaderMessage: "Use 'contrast sarif' to generate a SARIF file for the given application-id.",
         scanHeader: `Contrast Scan CLI`,
         assessHeader: `Contrast Assess CLI`,
         generateConfigHeader: `Contrast Generate Config`,

package/dist/index.js

@@ -78,7 +78,7 @@ const start = async () => {
                 return await processFingerprint(config, argvMain);
             }
             if (command === 'sarif') {
-                return processSarif(config, argvMain);
+                return await processSarif(config, argvMain);
             }
             if (command === 'learn') {
                 return processLearn();

package/dist/sarif/generateSarif.js

@@ -1,17 +1,26 @@
-import { getAuditConfig } from '../audit/auditConfig.js';
-import { scaCVES } from './sarifScaClient.js';
-import { iastData } from './sarifIastClient.js';
-import { writeCombinedSarif } from './sarifWriter.js';
+import { getSarifConfig } from './sarifConfig.js';
+import { writeSarif } from './sarifWriter.js';
+import { logInfo } from '../common/logging.js';
+import { sarifUsageGuide } from './help.js';
+import { sarifVulns } from './sarifClient.js';
 // This filename could be set by a customer
 // Defaulted to be ingested in a GH workflow
-const outputFileName = 'contrast.sarif.json';
+const outputFileName = 'contrast.sarif';
 export const processSarif = async (contrastConf, argvMain) => {
-    console.log('Generating SARIF export');
-    let config = await getAuditConfig(contrastConf, 'audit', argvMain);
-    const scaVulns = await scaCVES(config);
-    console.log(`Found ${scaVulns.length} SCA vulnerabilities`);
-    const iastVulns = await iastData(config);
-    console.log(`Found ${iastVulns.length} IAST vulnerabilities`);
-    writeCombinedSarif(iastVulns, scaVulns, outputFileName);
-    console.log('SARIF generated');
+    if (argvMain.indexOf('--help') !== -1 || argvMain.indexOf('help') !== -1) {
+        printHelpMessage();
+        process.exit(0);
+    }
+    let config = await getSarifConfig(contrastConf, 'sarif', argvMain);
+    logInfo('Generating SARIF file');
+    const sarifData = await sarifVulns(config);
+    if (sarifData === '') {
+        logInfo('No SARIF data found');
+        process.exit(0);
+    }
+    writeSarif(outputFileName, sarifData);
+    logInfo('contrast.sarif file generated successfully');
+};
+const printHelpMessage = () => {
+    logInfo(sarifUsageGuide);
 };

package/dist/sarif/help.js

@@ -0,0 +1,52 @@
+import commandLineUsage from 'command-line-usage';
+import i18n from 'i18n';
+import { commandLineDefinitions } from '../cliConstants.js';
+import { commonHelpLinks } from '../common/commonHelp.js';
+const { __ } = i18n;
+export const sarifUsageGuide = commandLineUsage([
+    {
+        header: __('constantsHeader')
+    },
+    {
+        header: __('sarifHeader'),
+        content: [__('sarifHeaderMessage')]
+    },
+    {
+        header: __('constantsPrerequisitesHeader'),
+        content: [__('constantsSarifPreRequisitesContent')]
+    },
+    {
+        header: __('constantsSarifOptions'),
+        optionList: commandLineDefinitions.sarifOptionDefinitions,
+        hide: [
+            'organization-id',
+            'api-key',
+            'authorization',
+            'host',
+            'proxy',
+            'cert',
+            'cacert',
+            'key',
+            'help',
+            'ff',
+            'cert-self-signed',
+            'debug',
+            'experimental',
+            'tags',
+            'sub-project',
+            'code',
+            'maven-settings-path',
+            'language',
+            'app-groups',
+            'branch',
+            'repo'
+        ]
+    },
+    {
+        header: __('constantsAdvancedOptions'),
+        optionList: commandLineDefinitions.sarifAdvancedOptionDefinitionsForHelp
+    },
+    commonHelpLinks()[0],
+    commonHelpLinks()[1],
+    commonHelpLinks()[2]
+]);

package/dist/sarif/sarifClient.js

@@ -0,0 +1,33 @@
+import { getSarifVulns } from './sarifRequests.js';
+export const sarifVulns = async (config) => {
+    let severities = [];
+    if (config.severity) {
+        severities = convertSeverityInput(config.severity);
+    }
+    const response = await getSarifVulns(config, severities);
+    if (response.statusCode === 200) {
+        console.log('Retrieved SARIF data');
+        return JSON.stringify(response.body, null, 2);
+    }
+    else {
+        console.log(`Error retrieving SARIF data`);
+        return '';
+    }
+};
+export function convertSeverityInput(severity) {
+    const severities = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'NOTE'];
+    switch (severity.toUpperCase()) {
+        case 'CRITICAL':
+            return severities.slice(0, 1);
+        case 'HIGH':
+            return severities.slice(0, 2);
+        case 'MEDIUM':
+            return severities.slice(0, 3);
+        case 'LOW':
+            return severities.slice(0, 4);
+        case 'NOTE':
+            return severities;
+        default:
+            return severities;
+    }
+}

package/dist/sarif/sarifConfig.js

@@ -0,0 +1,8 @@
+import { getCommandLineArgsCustom } from '../utils/parsedCLIOptions.js';
+import { commandLineDefinitions } from '../cliConstants.js';
+import { getAuth } from '../utils/paramsUtil/paramHandler.js';
+export const getSarifConfig = async (contrastConf, command, argv) => {
+    const sarifParameters = await getCommandLineArgsCustom(contrastConf, command, argv, commandLineDefinitions.sarifOptionDefinitions);
+    const paramsAuth = getAuth(sarifParameters);
+    return { ...paramsAuth, ...sarifParameters };
+};

package/dist/sarif/sarifRequests.js

@@ -0,0 +1,17 @@
+import { buildBaseRequestOptions, ErrorType } from '../common/baseRequest.js';
+import { got } from 'got';
+const getSarifUrl = (config) => {
+    return `${config.host}/Contrast/api/ng/organizations/${config.organizationId}/applications/${config.applicationId}/sarif`;
+};
+export function getSarifVulns(config, severities) {
+    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
+    options.url = getSarifUrl(config);
+    options.json = {
+        metadataFilters: config.metadata ? config.metadata : [],
+        // User can specify minimum severity, if none will include all
+        severities: severities,
+        // Allow user to specify toolTypes and default as both
+        toolTypes: config.toolType ? [config.toolType] : ['SCA', 'ASSESS']
+    };
+    return got.post(options);
+}

package/dist/sarif/sarifWriter.js

@@ -1,4 +1,4 @@
-import { SarifBuilder, SarifRunBuilder, SarifResultBuilder } from 'node-sarif-builder';
+import { SarifBuilder, SarifRunBuilder, SarifResultBuilder, SarifRuleBuilder } from 'node-sarif-builder';
 import fs from 'fs';
 export const mapSeverity = contrastSeverity => {
     switch (contrastSeverity.toLowerCase()) {
@@ -24,7 +24,7 @@ export const getFileFromTSDescription = description => {
 export const getLineFromTSDescription = description => {
     const regex = /\(.*:(\d*)\)/;
     const match = regex.exec(description);
-    return match ? parseInt(match[1]) : 0;
+    return match ? parseInt(match[1]) : 1;
 };
 export const getLogicalLocationFromTSDescription = description => {
     const regex = /(.*)\([^]+:\d*\)/;
@@ -42,14 +42,20 @@ export const generateIastSarifRun = traces => {
     }
     for (const trace of traces) {
         let extractedString = null;
-        if (trace.sink && trace.sink.label) {
-            extractedString = getFileFromTSDescription(trace.sink.label);
+        if (trace.trace.sink && trace.trace.sink.label) {
+            extractedString = getFileFromTSDescription(trace.trace.sink.label);
         }
         const sarifResultBuilder = new SarifResultBuilder().initSimple({
             ruleId: trace.trace.rule_title,
             messageText: trace.trace.title,
             level: mapSeverity(trace.trace.severity)
         });
+        const sarifRuleBuilder = new SarifRuleBuilder().initSimple({
+            ruleId: trace.trace.rule_title,
+            shortDescriptionText: trace.trace.title,
+            fullDescriptionText: trace.trace.title
+        });
+        sarifRunBuilderIast.addRule(sarifRuleBuilder);
         if (extractedString) {
             sarifResultBuilder.setLocationArtifactUri({ uri: extractedString });
         }
@@ -78,8 +84,26 @@ export const generateIastSarifRun = traces => {
                     return {
                         locations: [
                             {
+                                location: {
+                                    physicalLocation: {
+                                        artifactLocation: {
+                                            uri: getFileFromTSDescription(event.stacktraces[0].description)
+                                        },
+                                        region: {
+                                            startLine: getLineFromTSDescription(event.stacktraces[0].description)
+                                        }
+                                    },
+                                    logicalLocations: [
+                                        {
+                                            fullyQualifiedName: getLogicalLocationFromTSDescription(event.stacktraces[0].description)
+                                        }
+                                    ]
+                                },
                                 stack: {
-                                    frames: event.stacktraces.map(stacktrace => {
+                                    frames: event.stacktraces
+                                        .filter(stacktrace => getFileFromTSDescription(stacktrace.description) !==
+                                        'NOT AVAILABLE')
+                                        .map(stacktrace => {
                                         return {
                                             location: {
                                                 physicalLocation: {
@@ -108,6 +132,22 @@ export const generateIastSarifRun = traces => {
                 }
             }
         ];
+        sarifResultBuilder.result.locations = [];
+        sarifResultBuilder.result.locations.push({
+            physicalLocation: {
+                artifactLocation: {
+                    uri: getFileFromTSDescription(trace.trace.sink.label)
+                },
+                region: {
+                    startLine: getLineFromTSDescription(trace.trace.sink.label)
+                }
+            },
+            logicalLocations: [
+                {
+                    fullyQualifiedName: getLogicalLocationFromTSDescription(trace.trace.sink.label)
+                }
+            ]
+        });
         sarifRunBuilderIast.addResult(sarifResultBuilder);
     }
     return sarifRunBuilderIast;
@@ -138,7 +178,7 @@ export const generateScaSarifRun = cveList => {
     }
     return sarifRunBuilderSca;
 };
-export const writeCombinedSarif = (traces, cveList, output) => {
+export const writeCombinedSarif = (traces, cveList, outputFileName) => {
     const sarifBuilder = new SarifBuilder();
     const sarifRunBuilderIast = generateIastSarifRun(traces);
     sarifBuilder.addRun(sarifRunBuilderIast);
@@ -147,10 +187,13 @@ export const writeCombinedSarif = (traces, cveList, output) => {
     const sarifJsonString = sarifBuilder.buildSarifJsonString({
         indent: true
     }); // indent:true if you like
-    if (output) {
-        fs.writeFileSync(output, sarifJsonString);
+    writeSarif(outputFileName, sarifJsonString);
+};
+export const writeSarif = (outputFileName, sarifData) => {
+    if (outputFileName) {
+        fs.writeFileSync(outputFileName, sarifData);
     }
     else {
-        console.log(sarifJsonString);
+        console.log(sarifData);
     }
 };

package/dist/scaAnalysis/common/commonReportingFunctionsSca.js

@@ -25,7 +25,7 @@ export const printFormattedOutputSca = (config, reportModelList, numberOfVulnera
     const report = new ReportList();
     for (const library of reportModelList) {
         const { artifactName, version, vulnerabilities, remediationAdvice } = library;
-        const newOutputModel = new ReportModelStructure(new ReportCompositeKey(artifactName, version, findHighestSeverityCVESca(vulnerabilities), severityCountAllCVEsSca(vulnerabilities, new SeverityCountModel()).getTotal), vulnerabilities, remediationAdvice);
+        const newOutputModel = new ReportModelStructure(new ReportCompositeKey(artifactName, version, findHighestSeverityCVESca(vulnerabilities, config), severityCountAllCVEsSca(vulnerabilities, new SeverityCountModel()).getTotal), vulnerabilities, remediationAdvice);
         report.reportOutputList.push(newOutputModel);
     }
     const outputOrderedByLowestSeverityAndLowestNumOfCvesFirst = orderBy(report.reportOutputList, [
@@ -44,7 +44,7 @@ export const printFormattedOutputSca = (config, reportModelList, numberOfVulnera
         const numOfCVEs = reportModel.cveArray.length;
         const table = getReportTable();
         const header = buildHeader(highestSeverity, contrastHeaderNumCounter, libraryName, libraryVersion, numOfCVEs);
-        const body = buildBody(cveArray, remediationAdvice);
+        const body = buildBody(cveArray, remediationAdvice, config);
         const reportOutputModel = new ReportOutputModel(header, body);
         table.push(reportOutputModel.body.issueMessage, reportOutputModel.body.adviceMessage);
         logInfo(`${reportOutputModel.header.vulnMessage} ${reportOutputModel.header.introducesMessage}`);
@@ -98,8 +98,8 @@ export function buildHeader(highestSeverity, contrastHeaderNum, libraryName, ver
     const introducesMessage = `introduces ${numOfCVEs} ${vulnerabilityPluralised}`;
     return new ReportOutputHeaderModel(vulnMessage, introducesMessage);
 }
-export function buildBody(cveArray, advice) {
-    const orderedCvesWithSeverityAssigned = orderByHighestPrioritySca(cveArray.map(cve => findCVESeveritySca(cve)));
+export function buildBody(cveArray, advice, config) {
+    const orderedCvesWithSeverityAssigned = orderByHighestPrioritySca(cveArray.map(cve => findCVESeveritySca(cve, config)));
     const issueMessage = getIssueRow(orderedCvesWithSeverityAssigned);
     const adviceMessage = getAdviceRow(advice);
     return new ReportOutputBodyModel(issueMessage, adviceMessage);

package/dist/scaAnalysis/common/utils/reportUtilsSca.js

@@ -2,15 +2,16 @@ import { orderBy } from 'lodash-es';
 import { CRITICAL_COLOUR, CRITICAL_PRIORITY, HIGH_COLOUR, HIGH_PRIORITY, LOW_COLOUR, LOW_PRIORITY, MEDIUM_COLOUR, MEDIUM_PRIORITY, NOTE_COLOUR, NOTE_PRIORITY } from '../../../constants/constants.js';
 import { ReportSeverityModel } from '../../../audit/report/models/reportSeverityModel.js';
 import { ScaReportModel } from '../models/ScaReportModel.js';
-export function findHighestSeverityCVESca(cveArray) {
-    const mappedToReportSeverityModels = cveArray.map(cve => findCVESeveritySca(cve));
-    //order and get first
+import { logDebug } from '../../../common/logging.js';
+export function findHighestSeverityCVESca(cveArray, config) {
+    const mappedToReportSeverityModels = cveArray.map(cve => findCVESeveritySca(cve, config));
+    // order and get first
     return orderBy(mappedToReportSeverityModels, cve => cve?.priority)[0];
 }
 export function orderByHighestPrioritySca(reportSeverityModel) {
     return orderBy(reportSeverityModel, ['priority'], ['asc']);
 }
-export function findCVESeveritySca(vulnerabilityModel) {
+export function findCVESeveritySca(vulnerabilityModel, config) {
     const { name } = vulnerabilityModel;
     if (vulnerabilityModel.cvss3Severity === 'CRITICAL' ||
         vulnerabilityModel.severity === 'CRITICAL') {
@@ -32,6 +33,10 @@ export function findCVESeveritySca(vulnerabilityModel) {
         vulnerabilityModel.severity === 'NOTE') {
         return new ReportSeverityModel('NOTE', NOTE_PRIORITY, NOTE_COLOUR, name);
     }
+    else {
+        logDebug(config, `Unknown severity for vulnerability ${name} with cvss3severity of ${vulnerabilityModel.cvss3Severity} and and cvss severity of: ${vulnerabilityModel.severity}`);
+        return new ReportSeverityModel('NOTE', NOTE_PRIORITY, NOTE_COLOUR, name);
+    }
 }
 export function convertGenericToTypedReportModelSca(reportArray) {
     return reportArray.map((library) => {

package/dist/scaAnalysis/javascript/analysis.js

@@ -3,6 +3,7 @@ import { load } from 'js-yaml';
 import i18n from 'i18n';
 import { formatKey } from '../../audit/nodeAnalysisEngine/parseYarn2LockFileContents.js';
 import yarnpkg from '@yarnpkg/lockfile';
+import { buildDependencyTreeForV3LockFile } from './v3LockFileParser.js';
 export const readFile = async (config, languageFiles, nameOfFile) => {
     const index = languageFiles.findIndex(v => v.includes(nameOfFile));
     if (config.file) {
@@ -31,7 +32,7 @@ export const readYarn = async (config, languageFiles, nameOfFile) => {
         throw new Error(i18n.__('nodeReadYarnLockFileError') + `${err.message}`);
     }
 };
-export const parseNpmLockFile = async (npmLockFile) => {
+export const parseNpmLockFile = async (npmLockFile, lockFileVersion) => {
     try {
         if (!npmLockFile.parsedPackages) {
             npmLockFile.parsedPackages = {};
@@ -42,9 +43,15 @@ export const parseNpmLockFile = async (npmLockFile) => {
                 //e.g: node_modules/@aws-amplify/datastore/node_modules/uuid --> @aws-amplify/datastore/uuid
                 packageKey = packageKey.replace(/(node_modules\/)+/g, '');
             }
+            if (lockFileVersion === 3) {
+                delete packageValue.license;
+            }
             npmLockFile.parsedPackages[packageKey] = packageValue;
         });
-        //remove base project package - unneeded
+        if (lockFileVersion === 3) {
+            buildDependencyTreeForV3LockFile(npmLockFile);
+        }
+        // remove base project package - unneeded
         delete npmLockFile.parsedPackages[''];
         return npmLockFile;
     }

package/dist/scaAnalysis/javascript/index.js

@@ -47,12 +47,7 @@ const parseFiles = async (config, files, js) => {
             logDebug(config, message);
             throw new Error(message);
         }
-        if (currentLockFileVersion === 3 && config.legacy) {
-            const message = `NPM lockfileVersion 3 is not support with --legacy`;
-            logDebug(config, message);
-            throw new Error(message);
-        }
-        js.npmLockFile = await parseNpmLockFile(npmLockFile);
+        js.npmLockFile = await parseNpmLockFile(npmLockFile, currentLockFileVersion);
     }
     if (files.includes('yarn.lock')) {
         js = await parseYarnLockFile(js);

package/dist/scaAnalysis/javascript/v3LockFileParser.js

@@ -0,0 +1,107 @@
+export const buildDependencyTreeForV3LockFile = npmLockFile => {
+    let npmLockFileWithDepsObject = createDepTreeObject(npmLockFile);
+    const distinguishedDeps = distinguishParentAndTransitiveDependencies(npmLockFileWithDepsObject.dependencies);
+    assignChildrenToParents(distinguishedDeps.transitive, distinguishedDeps.parents, npmLockFile);
+};
+export const createDepTreeObject = npmLockFile => {
+    const parsedPackages = npmLockFile.parsedPackages;
+    let dependencies = {};
+    for (let dep in parsedPackages) {
+        dependencies[dep] = {
+            version: parsedPackages[dep].version,
+            resolved: parsedPackages[dep].resolved,
+            integrity: parsedPackages[dep].integrity,
+            ...(parsedPackages[dep].peer != null
+                ? { peer: parsedPackages[dep].peer }
+                : {}),
+            ...(parsedPackages[dep].optional != null
+                ? { optional: parsedPackages[dep].optional }
+                : {}),
+            ...(parsedPackages[dep].dev != null
+                ? { dev: parsedPackages[dep].dev }
+                : {}),
+            ...(parsedPackages[dep].dependencies != null
+                ? { requires: parsedPackages[dep].dependencies }
+                : {})
+        };
+        npmLockFile.dependencies = dependencies;
+        delete npmLockFile.dependencies[''];
+    }
+    return npmLockFile;
+};
+export const distinguishParentAndTransitiveDependencies = dependencies => {
+    let listOfParentObjects = {};
+    let listOfChildObjects = {};
+    for (let library in dependencies) {
+        let library_name = filterDependency(library.split('/'));
+        if (library_name.length === 1) {
+            Object.assign(listOfParentObjects, {
+                [library_name]: dependencies[library]
+            });
+        }
+        else {
+            if (library_name.join('/').includes('@') && library_name.length === 2) {
+                Object.assign(listOfParentObjects, {
+                    [library_name.join('/')]: dependencies[library]
+                });
+            }
+            else {
+                Object.assign(listOfChildObjects, {
+                    [library_name.join('/')]: dependencies[library]
+                });
+            }
+        }
+    }
+    return { parents: listOfParentObjects, transitive: listOfChildObjects };
+};
+export const assignChildrenToParents = (transitiveDeps, parentDeps, npmLockFile) => {
+    for (let child in transitiveDeps) {
+        let group = child.split('/');
+        let name = group.pop();
+        if (parentDeps[group.join('/')] === undefined) {
+            let additionalName = group.pop();
+            if (parentDeps[group.join('/')] !== undefined) {
+                let newName = additionalName + '/' + name;
+                addDependencyToNode(parentDeps[group.join('/')], transitiveDeps[child], newName);
+                delete transitiveDeps[child];
+            }
+            else {
+                console.log('WARNING: Unable to find parent dependency for ', child);
+                console.log('Adding as a parent dependency');
+                Object.assign(parentDeps, { [child]: transitiveDeps[child] });
+            }
+        }
+        else {
+            addDependencyToNode(parentDeps[group.join('/')], transitiveDeps[child], name);
+            delete transitiveDeps[child];
+        }
+    }
+    delete npmLockFile.dependencies;
+    npmLockFile.dependencies = parentDeps;
+    return npmLockFile;
+};
+export const filterDependency = inputString => {
+    let foundFirstInstance = false;
+    // Filter the parts to remove any item containing '@' except for the first instance
+    const filteredParts = inputString.filter(part => {
+        if (part.includes('@')) {
+            if (!foundFirstInstance) {
+                foundFirstInstance = true;
+                return true;
+            }
+            return false;
+        }
+        return true;
+    });
+    return filteredParts;
+};
+export function addDependencyToNode(baseObject, newDependency, potentialChildDeps) {
+    // Ensure the dependencies node exists
+    if (!baseObject.dependencies) {
+        baseObject.dependencies = {};
+    }
+    // Add the new dependency
+    Object.assign(baseObject.dependencies, {
+        [potentialChildDeps]: newDependency
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/contrast",
-  "version": "2.1.7",
+  "version": "2.3.0",
   "description": "Contrast Security's command line tool",
   "exports": "./dist/index.js",
   "type": "module",
@@ -30,15 +30,15 @@
     "build-package": "yarn build && yarn build-binary && yarn package-binary",
     "test": "export VITEST_MAX_THREADS=4 && export VITEST_MIN_THREADS=1 && vitest --dir ./tests/unit-tests/",
     "test-debug": "export VITEST_MAX_THREADS=4 && export VITEST_MIN_THREADS=1 && vitest --dir ./tests/unit-tests/ --inspect-brk",
-    "test-int": "vitest --dir ./tests/integration-tests/ --no-threads",
-    "test-int-scan": "vitest --dir ./tests/integration-tests/scan --no-threads",
-    "test-int-audit": "vitest --dir ./tests/integration-tests/audit --no-threads",
-    "test-int-scan-errors": "vitest ./tests/integration-tests/scan/scanLocalErrors.spec.js --no-threads",
-    "test-int-scan-reports": "vitest ./tests/integration-tests/scan/scanReport.spec.js --no-threads",
-    "test-int-audit-features": "vitest --dir ./tests/integration-tests/audit/auditFeatures/ --no-threads",
-    "test-int-audit-projects": "vitest ./tests/integration-tests/audit/audit-projects.spec.js --no-threads",
-    "test-int-fingerprint": "vitest ./tests/integration-tests/fingerprint/fingerprint.spec.js --no-threads",
-    "test-int-repository": "vitest ./tests/integration-tests/fingerprint/repository.spec.js --no-threads",
+    "test-int": "vitest --dir ./tests/integration-tests/ --pool=forks",
+    "test-int-scan": "vitest --dir ./tests/integration-tests/scan --pool=forks",
+    "test-int-audit": "vitest --dir ./tests/integration-tests/audit --pool=forks",
+    "test-int-scan-errors": "vitest ./tests/integration-tests/scan/scanLocalErrors.spec.js --pool=forks",
+    "test-int-scan-reports": "vitest ./tests/integration-tests/scan/scanReport.spec.js --pool=forks",
+    "test-int-audit-features": "vitest --dir ./tests/integration-tests/audit/auditFeatures/ --pool=forks",
+    "test-int-audit-projects": "vitest ./tests/integration-tests/audit/audit-projects.spec.js --pool=forks",
+    "test-int-fingerprint": "vitest ./tests/integration-tests/fingerprint/fingerprint.spec.js --pool=forks",
+    "test-int-repository": "vitest ./tests/integration-tests/fingerprint/repository.spec.js --pool=forks",
     "format": "prettier --write \"**/*.{ts,tsx,js,json,md,yml}\" .eslintrc.*",
     "check-format": "prettier --check \"**/*.{ts,tsx,js,json,md,yml,mjs,cjs}\" .eslintrc.*",
     "coverage-local": "c8 --reporter=text mocha './tests/unit-tests/**/*.spec.js'",
@@ -47,7 +47,7 @@
     "extract-licenses": "node scripts/extract-licenses",
     "lambda-dev": "npx ts-node src/index.ts lambda",
     "dev": "npx ts-node src/index.ts",
-    "proxy-tests": "vitest ./tests/integration-tests/proxy/proxy-coverage.spec.js --no-threads"
+    "proxy-tests": "vitest ./tests/integration-tests/proxy/proxy-coverage.spec.js --pool=forks"
   },
   "engines": {
     "node": ">=18.16.0"
@@ -116,7 +116,7 @@
     "ts-node": "^10.9.2",
     "typescript": "5.1.6",
     "uuid": "9.0.0",
-    "vitest": "0.33.0"
+    "vitest": "1.4.0"
   },
   "resolutions": {
     "faker": "5.5.3",

package/dist/sarif/sarifAssessRequests.js

@@ -1,39 +0,0 @@
-import { buildBaseRequestOptions, ErrorType } from '../common/baseRequest.js';
-import { got } from 'got';
-const getAssessTraceIdsUrl = (config, offset, resultsLimit) => {
-    return `${config.host}/Contrast/api/ng/${config.organizationId}/orgtraces/filter/?offset=${offset}&limit=${resultsLimit}`;
-};
-export function getAssessTraceIds(config, offset, resultsLimit) {
-    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
-    options.url = getAssessTraceIdsUrl(config, offset, resultsLimit);
-    options.json = {
-        applicationID: config.applicationId,
-        // metadataFilters: sessionMetadata,
-        severities: [config.severity]
-    };
-    return got.post(options);
-}
-const getAssessTraceDetailsUrl = (config, traceId) => {
-    return `${config.host}/Contrast/api/ng/${config.organizationId}/traces/${config.applicationId}/filter/${traceId}?expand=events,request,sink,${traceId},skip_links`;
-};
-export function getAssessTraceDetails(config, traceId) {
-    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
-    options.url = getAssessTraceDetailsUrl(config, traceId);
-    return got.get(options);
-}
-const getAssessTraceEventsUrl = (config, traceId, eventId) => {
-    return `${config.host}/Contrast/api/ng/${config.organizationId}/traces/${traceId}/events/${eventId}/details`;
-};
-export function getAssessTraceEvents(config, traceId, eventId) {
-    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
-    options.url = getAssessTraceEventsUrl(config, traceId, eventId);
-    return got.get(options);
-}
-const getAssessTraceRoutesUrl = (config, traceId) => {
-    return `${config.host}/Contrast/api/ng/${config.organizationId}/traces/${config.applicationId}/trace/${traceId}/routes`;
-};
-export function getAssessTraceRoutes(config, traceId) {
-    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
-    options.url = getAssessTraceRoutesUrl(config, traceId);
-    return got.get(options);
-}

package/dist/sarif/sarifIastClient.js

@@ -1,65 +0,0 @@
-import { getAssessTraceDetails, getAssessTraceEvents, getAssessTraceIds, getAssessTraceRoutes } from './sarifAssessRequests.js';
-const resultsLimit = 50;
-let offset = 0;
-export const iastData = async (config) => {
-    const filteredTraceIds = await getTraceIds(config, offset, resultsLimit);
-    console.log(`Found ${filteredTraceIds.length} traces`);
-    let completeTraces = [];
-    for (const traceId of filteredTraceIds) {
-        const traceDetails = await getTraceDetails(config, traceId);
-        const traceRoutes = await getTraceRoutes(config, traceId);
-        let eventsWithFrames = [];
-        if (traceDetails.events) {
-            for (const eventSummary of traceDetails.events) {
-                const eventDetails = await getTraceEvents(config, traceId, eventSummary.eventId);
-                eventsWithFrames.push(eventDetails);
-            }
-        }
-        completeTraces.push({
-            trace: traceDetails,
-            events: eventsWithFrames,
-            routes: traceRoutes
-        });
-    }
-    return completeTraces;
-};
-export async function getTraceIds(config, offset, resultsLimit) {
-    let hasResults = true;
-    let pivotedData = [];
-    while (hasResults) {
-        const response = getAssessTraceIds(config, offset, resultsLimit);
-        const responseBody = await response.json();
-        if (responseBody.traces == null) {
-            console.log('No libraries found');
-            return pivotedData;
-        }
-        const result = responseBody.traces;
-        const traceIds = result.map(trace => {
-            return trace.uuid;
-        });
-        pivotedData = pivotedData.concat(traceIds);
-        if (result.length < resultsLimit) {
-            hasResults = false;
-        }
-        offset += resultsLimit;
-    }
-    return pivotedData;
-}
-export async function getTraceDetails(config, traceId) {
-    console.log(`Getting trace details for ${traceId} of application ${config.applicationId}`);
-    const response = getAssessTraceDetails(config, traceId);
-    const responseBody = await response.json();
-    return responseBody.trace;
-}
-export async function getTraceEvents(config, traceId, eventId) {
-    const response = getAssessTraceEvents(config, traceId, eventId);
-    console.log(`Getting trace events for ${eventId} of trace ${traceId}`);
-    const responseBody = await response.json();
-    return responseBody.event;
-}
-export async function getTraceRoutes(config, traceId) {
-    console.log(`Getting trace route for ${traceId} of application ${config.applicationId}`);
-    const response = getAssessTraceRoutes(config, traceId);
-    const responseBody = await response.json();
-    return responseBody.routes;
-}

package/dist/sarif/sarifSCARequests.js

@@ -1,25 +0,0 @@
-import { buildBaseRequestOptions, ErrorType } from '../common/baseRequest.js';
-import { got } from 'got';
-const getSCAVulnsUrl = (config, offset, resultsLimit) => {
-    return `${config.host}/Contrast/api/ng/${config.organizationId}/libraries/filter?expand=skip_links,apps,quickFilters,vulns,status,usage_counts&offset=${offset}&limit=${resultsLimit}&sort=score`;
-};
-export function getSCAVulns(config, offset, resultsLimit) {
-    const options = buildBaseRequestOptions(config, ErrorType.GENERIC);
-    options.url = getSCAVulnsUrl(config, offset, resultsLimit);
-    options.json = {
-        q: '',
-        quickFilter: 'VULNERABLE',
-        apps: [config.applicationId],
-        servers: [],
-        environments: [],
-        grades: [],
-        languages: [],
-        licenses: [],
-        status: [],
-        severities: [config.severity],
-        tags: [],
-        includeUnused: false,
-        includeUsed: false
-    };
-    return got.post(options);
-}

package/dist/sarif/sarifScaClient.js

@@ -1,35 +0,0 @@
-import { getSCAVulns } from './sarifSCARequests.js';
-const resultsLimit = 50;
-let offset = 0;
-export const scaCVES = async (config) => {
-    let hasResults = true;
-    let pivotedData = [];
-    while (hasResults) {
-        const response = getSCAVulns(config, offset, resultsLimit);
-        const responseBody = await response.json();
-        if (responseBody.libraries == null) {
-            console.log('No libraries found');
-            return pivotedData;
-        }
-        // Finds all libraries with a vulnerability of specified severity
-        const result = responseBody.libraries.flatMap(item => {
-            const { vulns } = item;
-            return vulns.flatMap(vuln => {
-                vuln.library = item;
-                return vuln;
-            });
-        });
-        // All vulns associated with the library will be returned,
-        // so we must filter by severity again
-        for (const vuln of result) {
-            if (vuln.severityToUse.toLowerCase() === config.severity) {
-                pivotedData.push(vuln);
-            }
-        }
-        if (result.length < resultsLimit) {
-            hasResults = false;
-        }
-        offset += resultsLimit;
-    }
-    return pivotedData;
-};