@contrast/contrast 2.3.0 → 2.3.2

package/dist/audit/report/models/reportListModel.js

@@ -17,4 +17,12 @@ export class ReportCompositeKey {
         this.highestSeverity = highestSeverity;
         this.numberOfSeverities = numberOfSeverities;
     }
+    toString() {
+        return `ReportCompositeKey { 
+      libraryName: ${this.libraryName}, 
+      libraryVersion: ${this.libraryVersion}, 
+      highestSeverity: ${this.highestSeverity}, 
+      numberOfSeverities: ${this.numberOfSeverities} 
+    }`;
+    }
 }

package/dist/audit/report/models/reportSeverityModel.js

@@ -5,4 +5,12 @@ export class ReportSeverityModel {
         this.colour = colour;
         this.name = name;
     }
+    toString() {
+        return `ReportSeverityModel { 
+      severity: ${this.severity}, 
+      priority: ${this.priority}, 
+      colour: ${this.colour}, 
+      name: ${this.name} 
+    }`;
+    }
 }

package/dist/constants/constants.js

@@ -17,7 +17,7 @@ export const HIGH = 'HIGH';
 export const CRITICAL = 'CRITICAL';
 // App
 export const APP_NAME = 'contrast';
-const APP_VERSION = '2.3.0';
+const APP_VERSION = '2.3.2';
 export const TIMEOUT = 120000;
 export const CRITICAL_PRIORITY = 1;
 export const HIGH_PRIORITY = 2;

package/dist/constants/locales.js

@@ -53,6 +53,7 @@ export const en_locales = () => {
         failSeverityOptionErrorMessage: ' FAIL - Results detected vulnerabilities over accepted severity level',
         constantsSeverity: 'Use with "contrast scan --fail --severity high" or "contrast audit --fail --severity high". Set the severity level to detect vulnerabilities or dependencies. Severity levels are critical, high, medium, low or note.',
         constantsSarifSeverity: 'Set the severity level to filter the vulnerabilities included in the SARIF output. Severity levels are critical, high, medium, low or note.',
+        constantsToolType: 'The tools that are included in the generated SARIF file. Valid options are SCA or ASSESS. The default value is both.',
         constantsHeader: `Contrast CLI @ v${getAppVersion()}`,
         configHeader2: 'Config options',
         clearHeader: '-c, --clear',

package/dist/scaAnalysis/common/commonReportingFunctionsSca.js

@@ -3,12 +3,12 @@ import { countVulnerableLibrariesBySeverity } from '../../audit/report/utils/rep
 import { SeverityCountModel } from '../../audit/report/models/severityCountModel.js';
 import { orderBy } from 'lodash-es';
 import { ReportOutputModel, ReportOutputHeaderModel, ReportOutputBodyModel } from '../../audit/report/models/reportOutputModel.js';
-import { CE_URL, CRITICAL_COLOUR, HIGH_COLOUR, MEDIUM_COLOUR, LOW_COLOUR, NOTE_COLOUR } from '../../constants/constants.js';
+import { CE_URL, CRITICAL_COLOUR, HIGH_COLOUR, MEDIUM_COLOUR, LOW_COLOUR, NOTE_COLOUR, NOTE_PRIORITY } from '../../constants/constants.js';
 import Table from 'cli-table3';
 import { findHighestSeverityCVESca, severityCountAllCVEsSca, findCVESeveritySca, orderByHighestPrioritySca } from './utils/reportUtilsSca.js';
 import chalk from 'chalk';
 import { buildFormattedHeaderNum } from '../../audit/report/commonReportingFunctions.js';
-import { logInfo } from '../../common/logging.js';
+import { logDebug, logInfo } from '../../common/logging.js';
 export const createSummaryMessageTop = (numberOfVulnerableLibraries, numberOfCves) => {
     numberOfVulnerableLibraries === 1
         ? logInfo(`\n\nFound 1 vulnerable library containing ${numberOfCves} CVE`)
@@ -25,11 +25,23 @@ export const printFormattedOutputSca = (config, reportModelList, numberOfVulnera
     const report = new ReportList();
     for (const library of reportModelList) {
         const { artifactName, version, vulnerabilities, remediationAdvice } = library;
-        const newOutputModel = new ReportModelStructure(new ReportCompositeKey(artifactName, version, findHighestSeverityCVESca(vulnerabilities, config), severityCountAllCVEsSca(vulnerabilities, new SeverityCountModel()).getTotal), vulnerabilities, remediationAdvice);
-        report.reportOutputList.push(newOutputModel);
+        if (vulnerabilities.length === 0) {
+            logDebug(config, `Unable to find vulnerability for ${artifactName} version ${version}`);
+        }
+        else {
+            const highestSeverity = findHighestSeverityCVESca(vulnerabilities, config);
+            const severityCount = severityCountAllCVEsSca(vulnerabilities, new SeverityCountModel()).getTotal;
+            if (highestSeverity.priority === undefined) {
+                highestSeverity.priority = NOTE_PRIORITY;
+                logDebug(config, `Unknown severity for vulnerability ${artifactName}`);
+            }
+            const newOutputModel = new ReportModelStructure(new ReportCompositeKey(artifactName, version, highestSeverity, severityCount), vulnerabilities, remediationAdvice);
+            report.reportOutputList.push(newOutputModel);
+        }
     }
     const outputOrderedByLowestSeverityAndLowestNumOfCvesFirst = orderBy(report.reportOutputList, [
         reportListItem => {
+            logDebug(config, reportListItem.compositeKey);
             return reportListItem.compositeKey.highestSeverity.priority;
         },
         reportListItem => {
@@ -99,6 +111,7 @@ export function buildHeader(highestSeverity, contrastHeaderNum, libraryName, ver
     return new ReportOutputHeaderModel(vulnMessage, introducesMessage);
 }
 export function buildBody(cveArray, advice, config) {
+    logDebug(config, `buildBody 204: ${JSON.stringify(cveArray)}`);
     const orderedCvesWithSeverityAssigned = orderByHighestPrioritySca(cveArray.map(cve => findCVESeveritySca(cve, config)));
     const issueMessage = getIssueRow(orderedCvesWithSeverityAssigned);
     const adviceMessage = getAdviceRow(advice);

package/dist/scaAnalysis/common/utils/reportUtilsSca.js

@@ -4,6 +4,7 @@ import { ReportSeverityModel } from '../../../audit/report/models/reportSeverity
 import { ScaReportModel } from '../models/ScaReportModel.js';
 import { logDebug } from '../../../common/logging.js';
 export function findHighestSeverityCVESca(cveArray, config) {
+    logDebug(config, `\n  findHighestSeverityCVESca 25: ${JSON.stringify(cveArray)} \n`);
     const mappedToReportSeverityModels = cveArray.map(cve => findCVESeveritySca(cve, config));
     // order and get first
     return orderBy(mappedToReportSeverityModels, cve => cve?.priority)[0];
@@ -13,6 +14,7 @@ export function orderByHighestPrioritySca(reportSeverityModel) {
 }
 export function findCVESeveritySca(vulnerabilityModel, config) {
     const { name } = vulnerabilityModel;
+    logDebug(config, `\n findCVESeveritySca 44: ${JSON.stringify(vulnerabilityModel)} \n`);
     if (vulnerabilityModel.cvss3Severity === 'CRITICAL' ||
         vulnerabilityModel.severity === 'CRITICAL') {
         return new ReportSeverityModel('CRITICAL', CRITICAL_PRIORITY, CRITICAL_COLOUR, name);

package/dist/scaAnalysis/scaAnalysis.js

@@ -21,6 +21,7 @@ import { auditUsageGuide } from '../audit/help.js';
 import chalk from 'chalk';
 import { logDebug, logInfo } from '../common/logging.js';
 export const processSca = async (config) => {
+    logDebug(config, `audit started at ${new Date().toISOString()}`);
     let filesFound;
     if (config.help) {
         logInfo(auditUsageGuide);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/contrast",
-  "version": "2.3.0",
+  "version": "2.3.2",
   "description": "Contrast Security's command line tool",
   "exports": "./dist/index.js",
   "type": "module",