Documentation
¶
Overview ¶
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Package scan implements functions and helpers to ensure the proper scan of the specified files
- Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
- This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Index ¶
- func ApplyPlatformFilters(cliPlatforms, onlyPlatforms, ignorePlatforms []string) []string
- func RunCustomRegoQuery(ctx context.Context, platform string, regoContent string, fileContent []byte) ([]model.Vulnerability, map[string]error, error)
- type Client
- type Parameters
- type RegoValidationError
- type Results
- type RuleStats
- type RuleTiming
- type ScanMetadata
- type ScanStats
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ApplyPlatformFilters ¶ added in v1.3.2
ApplyPlatformFilters intersects cliPlatforms with the only/ignore lists from the IaC config, returning the set of platforms that should actually be scanned.
func RunCustomRegoQuery ¶ added in v1.6.0
func RunCustomRegoQuery( ctx context.Context, platform string, regoContent string, fileContent []byte, ) ([]model.Vulnerability, map[string]error, error)
RunCustomRegoQuery writes fileContent to a temp file and runs regoContent against it using the same OPA setup as a normal scan.
Types ¶
type Client ¶
type Client struct {
ScanParams *Parameters
ScanStartTime time.Time
Tracker *tracker.CITracker
Storage *storage.MemoryStorage
Printer *consolePrinter.Printer
FlagEvaluator featureflags.FlagEvaluator
// contains filtered or unexported fields
}
Client represents a scan client
func NewClient ¶
func NewClient(ctx context.Context, params *Parameters, customPrint *consolePrinter.Printer) (*Client, error)
NewClient initializes the client with all the required parameters
func (*Client) GetQueryPath ¶
GetQueryPath gets all the queries paths
func (*Client) PerformScan ¶
func (c *Client) PerformScan(ctx context.Context) (ScanMetadata, error)
PerformScan executes executeScan and postScan
type Parameters ¶
type Parameters struct {
CloudProvider []string
ExperimentalQueries bool
InputData string
OutputName string
OutputPath string
RepoPath string
Path []string
PayloadPath string
PreviewLines int
QueriesPath []string
LibrariesPath string
ReportFormats []string
Platform []string
TerraformVarsPath string
LineInfoPayload bool
DisableSecrets bool
SecretsRegexesPath string
ChangedDefaultQueryPath bool
ChangedDefaultLibrariesPath bool
ScanID string
BillOfMaterials bool
ExcludeGitIgnore bool
OpenAPIResolveReferences bool
ParallelScanFlag int
MaxFileSizeFlag int
UseOldSeverities bool
MaxResolverDepth int
PreAnalysisExcludePaths []string
SCIInfo model.SCIInfo
FlagEvaluator featureflags.FlagEvaluator
Config config.IacConfig
}
Parameters represents all available scan parameters
func GetDefaultParameters ¶
func (*Parameters) GetEffectivePlatforms ¶ added in v1.3.2
func (p *Parameters) GetEffectivePlatforms() []string
type RegoValidationError ¶ added in v1.6.0
type RegoValidationError struct {
Code string `json:"code"`
Message string `json:"message"`
StartLine int `json:"start_line"`
StartCol int `json:"start_col"`
EndLine int `json:"end_line"`
EndCol int `json:"end_col"`
}
RegoValidationError is a compile-time or static-analysis error with source location.
func ValidateCustomRegoQuery ¶ added in v1.6.0
func ValidateCustomRegoQuery( ctx context.Context, platform string, regoContent string, ) ([]RegoValidationError, error)
ValidateCustomRegoQuery runs three diagnostic phases against regoContent and returns all errors in a single call — parse errors, static AST checks, and OPA compilation errors are collected independently so no phase gates another:
- Parse: syntax errors enriched with precise locations.
- Static checks: package name, rule name, result fields, sprintf arity, missing imports.
- OPA compile against platform libraries: type errors and unresolved references.
Returns (nil, nil) on success, (errors, nil) on validation failure.
func ValidateRegoStructure ¶ added in v1.6.0
func ValidateRegoStructure(regoContent string) []RegoValidationError
ValidateRegoStructure parses regoContent and runs every static check without loading platform libraries — cheaper than ValidateCustomRegoQuery when library compilation is not needed. Does not recover from a missing package declaration; use ValidateCustomRegoQuery for full user-facing validation.
type Results ¶
type Results struct {
Results []model.Vulnerability
ExtractedPaths provider.ExtractedPath
Files model.FileMetadatas
FailedQueries map[string]error
}
Results represents a result generated by a single scan
type RuleStats ¶
type RuleStats struct {
// TimedOut contains a list of rules that timed out.
TimedOut []string
// MostExpensiveRule contains the rule that spent the most time executing during the analysis.
MostExpensiveRule RuleTiming
// SlowestRule contains the rule that spent the most time executing per file.
SlowestRule RuleTiming
}
type RuleTiming ¶
type ScanMetadata ¶
type ScanMetadata struct {
// StartTime contains the instant in which the analysis started.
StartTime time.Time
// EndTime contains the instant in which the analysis ended.
EndTime time.Time
// DiffAware contains whether the analyzer could use Diff-Aware scanning.
DiffAware bool
// CoresAvailable contains the number of cores that were available to the analyzer.
CoresAvailable int
// Stats contains statistics about the analysis.
Stats ScanStats
// RuleStats contains statistics about rules.
RuleStats RuleStats
}
type ScanStats ¶
type ScanStats struct {
// Violations contains the number of violations that were found.
Violations int
// Files contains the number of files that were analyzed.
Files int
// Rules contains the number of rules that were evaluated.
Rules int
// Duration contains the time it took to complete the analysis.
Duration time.Duration
// ViolationBreakdowns contains a breakdown of the violations by severity.
ViolationBreakdowns map[string]map[string]int
// ResourcesFound contains the number of resources that were analyzed.
ResourcesScanned int
}