scan

package
v1.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 25, 2026 License: Apache-2.0 Imports: 45 Imported by: 0

Documentation

Overview

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

Package scan implements functions and helpers to ensure the proper scan of the specified files

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ApplyPlatformFilters added in v1.3.2

func ApplyPlatformFilters(cliPlatforms, onlyPlatforms, ignorePlatforms []string) []string

ApplyPlatformFilters intersects cliPlatforms with the only/ignore lists from the IaC config, returning the set of platforms that should actually be scanned.

func RunCustomRegoQuery added in v1.6.0

func RunCustomRegoQuery(
	ctx context.Context,
	platform string,
	regoContent string,
	fileContent []byte,
) ([]model.Vulnerability, map[string]error, error)

RunCustomRegoQuery writes fileContent to a temp file and runs regoContent against it using the same OPA setup as a normal scan.

Types

type Client

type Client struct {
	ScanParams    *Parameters
	ScanStartTime time.Time
	Tracker       *tracker.CITracker
	Storage       *storage.MemoryStorage
	Printer       *consolePrinter.Printer
	FlagEvaluator featureflags.FlagEvaluator
	// contains filtered or unexported fields
}

Client represents a scan client

func NewClient

func NewClient(ctx context.Context, params *Parameters, customPrint *consolePrinter.Printer) (*Client, error)

NewClient initializes the client with all the required parameters

func (*Client) GetQueryPath

func (c *Client) GetQueryPath(ctx context.Context) (provider.ExtractedPath, error)

GetQueryPath gets all the queries paths

func (*Client) PerformScan

func (c *Client) PerformScan(ctx context.Context) (ScanMetadata, error)

PerformScan executes executeScan and postScan

type Parameters

type Parameters struct {
	CloudProvider               []string
	ExperimentalQueries         bool
	InputData                   string
	OutputName                  string
	OutputPath                  string
	RepoPath                    string
	Path                        []string
	PayloadPath                 string
	PreviewLines                int
	QueriesPath                 []string
	LibrariesPath               string
	ReportFormats               []string
	Platform                    []string
	TerraformVarsPath           string
	LineInfoPayload             bool
	DisableSecrets              bool
	SecretsRegexesPath          string
	ChangedDefaultQueryPath     bool
	ChangedDefaultLibrariesPath bool
	ScanID                      string
	BillOfMaterials             bool
	ExcludeGitIgnore            bool
	OpenAPIResolveReferences    bool
	ParallelScanFlag            int
	MaxFileSizeFlag             int
	UseOldSeverities            bool
	MaxResolverDepth            int
	PreAnalysisExcludePaths     []string
	SCIInfo                     model.SCIInfo
	FlagEvaluator               featureflags.FlagEvaluator
	Config                      config.IacConfig
}

Parameters represents all available scan parameters

func GetDefaultParameters

func GetDefaultParameters(ctx context.Context, rootPath string) (*Parameters, context.Context)

func (*Parameters) GetEffectivePlatforms added in v1.3.2

func (p *Parameters) GetEffectivePlatforms() []string

type RegoValidationError added in v1.6.0

type RegoValidationError struct {
	Code      string `json:"code"`
	Message   string `json:"message"`
	StartLine int    `json:"start_line"`
	StartCol  int    `json:"start_col"`
	EndLine   int    `json:"end_line"`
	EndCol    int    `json:"end_col"`
}

RegoValidationError is a compile-time or static-analysis error with source location.

func ValidateCustomRegoQuery added in v1.6.0

func ValidateCustomRegoQuery(
	ctx context.Context,
	platform string,
	regoContent string,
) ([]RegoValidationError, error)

ValidateCustomRegoQuery runs three diagnostic phases against regoContent and returns all errors in a single call — parse errors, static AST checks, and OPA compilation errors are collected independently so no phase gates another:

  1. Parse: syntax errors enriched with precise locations.
  2. Static checks: package name, rule name, result fields, sprintf arity, missing imports.
  3. OPA compile against platform libraries: type errors and unresolved references.

Returns (nil, nil) on success, (errors, nil) on validation failure.

func ValidateRegoStructure added in v1.6.0

func ValidateRegoStructure(regoContent string) []RegoValidationError

ValidateRegoStructure parses regoContent and runs every static check without loading platform libraries — cheaper than ValidateCustomRegoQuery when library compilation is not needed. Does not recover from a missing package declaration; use ValidateCustomRegoQuery for full user-facing validation.

type Results

type Results struct {
	Results        []model.Vulnerability
	ExtractedPaths provider.ExtractedPath
	Files          model.FileMetadatas
	FailedQueries  map[string]error
}

Results represents a result generated by a single scan

type RuleStats

type RuleStats struct {
	// TimedOut contains a list of rules that timed out.
	TimedOut []string
	// MostExpensiveRule contains the rule that spent the most time executing during the analysis.
	MostExpensiveRule RuleTiming
	// SlowestRule contains the rule that spent the most time executing per file.
	SlowestRule RuleTiming
}

type RuleTiming

type RuleTiming struct {
	Name string
	Time time.Duration
}

type ScanMetadata

type ScanMetadata struct {
	// StartTime contains the instant in which the analysis started.
	StartTime time.Time
	// EndTime contains the instant in which the analysis ended.
	EndTime time.Time
	// DiffAware contains whether the analyzer could use Diff-Aware scanning.
	DiffAware bool
	// CoresAvailable contains the number of cores that were available to the analyzer.
	CoresAvailable int
	// Stats contains statistics about the analysis.
	Stats ScanStats
	// RuleStats contains statistics about rules.
	RuleStats RuleStats
}

type ScanStats

type ScanStats struct {
	// Violations contains the number of violations that were found.
	Violations int
	// Files contains the number of files that were analyzed.
	Files int
	// Rules contains the number of rules that were evaluated.
	Rules int
	// Duration contains the time it took to complete the analysis.
	Duration time.Duration
	// ViolationBreakdowns contains a breakdown of the violations by severity.
	ViolationBreakdowns map[string]map[string]int
	// ResourcesFound contains the number of resources that were analyzed.
	ResourcesScanned int
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL