CLI commands

The CLI offers a command line help guide with the --h or --help option. The help guide displays the following commands you can use to understand more about Contrast configuration, applications, and vulnerabilities.

In the following examples, replace <string> or <level> with the string or level value that applies to your particular situation.

General commands

Connection and configuration commands.

Command

Description

--api_key <string>

An agent API key provided by Contrast (required)

--application_id <string>

The ID of the application cataloged by Contrast (required)

application_name <string>

The name of the application cataloged by Contrast (optional)

--authorization <string>

Agent authorization credentials provided by Contrast (required)

-h, --help

Displays the help guide.

--host <string>

The name of the host and, optionally, the port expressed as <host>:<port>. Does not include the protocol section of the URL (https://). Defaults to app.contrastsecurity.com . (optional)

--language <string>

Valid values are JAVA, NODE, PYTHON, RUBY and GO. If there are multiple project configuration files in the project_path, language is required. (required for catalogue)

--organization_id <string>

The ID of your organization in Contrast (required)

--project_path <string>

The directory root of a project/application that you want to analyze. Defaults to the current directory. (optional)

--proxy <string>

Allows for connection over a proxy server. If authentication is required, provide the username and password with the protocol, host and port. For example, http://username:password@<host>:<port>. (optional)

--sub_project <string>

Specifies the subproject within a gradle application. (optional)

-v, --version

Displays the CLI version you are currently using

--yaml_path <string>

The path to display parameters from the YAML file (optional)

If yaml_path is used, the following connection parameters are ignored from the terminal:

  • yamlOnly:

  • key:pathToKey

  • cert:pathToCert

  • cacert:pathToCaCert

Note

Parameters in these commands may need to be quoted to avoid issues with special characters. For example:

--application_name = "My_app_name_$+=(/\"

OSS

Commands related to Contrast OSS examination.

Command

Description

Catalogue applications

--app_groups <string>

Assigns your application to one or more pre-existing groups when using the catalogue command. Group lists should be comma separated. (optional)

--catalogue_application

Catalog an application (required)

--code <string>

The application code this application should use in Contrast (optional)

--metadata <string>

Define a set of key=value pairs (which conforms to RFC 2253) for specifying user-defined metadata associated with the application (optional)

--tags <string>

Apply labels to an application. Labels must be formatted as a comma-delimited list. Example - label1,label2,label3 (optional)

Snapshot - default command does not have a command on the terminal. Java only.

--maven_settings_path <PathToFile>

Allows you to specify an alternative location for your maven settings.xml file. Replace <PathToFile> with the full path for the file. Add this path to the full set of keys when you register your application with the CLI. (optional)

--silent

Silences JSON output. (optional)

Reports

--cve_severity <level>

Combined with --report, allows the user to report libraries with vulnerabilities above a chosen severity level. For example, cve_severity medium only reports vulnerabilities at Medium or higher severity.

--cve_threshold <number>

Sets the number of CVEs allowed before a build is failed. If there are more CVEs than the threshold, the build will fail.

--fail

Fails the build if any vulnerabilities are found. Can be used in combination with cve_severity to fail builds with vulnerabilities at severity levels defined by the user.

--report

Shows a report of vulnerabilities in the application from compile time

SBOM

--sbom

Generate and download a Software bill of materials (SBOM) in CycloneDX JSON format

Tip

The --report command can be used to return details of all vulnerable libraries in the terminal response. Every CVE found will have output like this:

org.webjars/jquery-ui/1.11.4 is vulnerable

CVE-2016-7103 MEDIUMCross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

The vulnerable records returned can be restricted by using the cve_severity parameter which sets the minimum threshold for a CVE to be reported.

To prevent an application from being deployed with a library above a severity threshold the --fail parameter can be used as part of an automated CI/CD pipeline. For example, you can run the CLI using a YAML file with:

contrast-cli --yaml_path path/to/yaml --report --cve_severity high --fail

Scan

Commands related to Contrast Scan. See also Integrate scans with builds.

Command

Description

--project_id <ProjectID>

The ID associated with a scan project. Replace <ProjectID> with the ID for the scan project. To find the ID, select a scan project in Contrast and locate the last number in the URL.

project_name

The name of the scan project in Contrast.

--scan<FileToBeScanned>

Starts a static scan of the specified WAR or JAR file. Replace <FileToBeScanned> with the path of the WAR or JAR file that you want to upload for scanning.

--scan_timeout

Set a specific time span (in seconds) before the function times out. Default timeout is 20 seconds if scan_timeout is not set.

--wait_for_scan

Waits for the result of the scan

In this section: