Documentation
¶
Overview ¶
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Package scan implements functions and helpers to ensure the proper scan of the specified files
- Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
- This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Index ¶
- func ApplyPlatformFilters(cliPlatforms, onlyPlatforms, ignorePlatforms []string) []string
- func RunCustomRegoQuery(ctx context.Context, platform string, regoContent string, fileContent []byte) ([]model.Vulnerability, map[string]error, error)
- type Client
- type ClientOption
- type Parameters
- type RegoValidationError
- type Results
- type RuleStats
- type RuleTiming
- type ScanMetadata
- type ScanStats
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ApplyPlatformFilters ¶ added in v1.3.2
ApplyPlatformFilters intersects cliPlatforms with the only/ignore lists from the IaC config, returning the set of platforms that should actually be scanned.
func RunCustomRegoQuery ¶ added in v1.6.0
func RunCustomRegoQuery( ctx context.Context, platform string, regoContent string, fileContent []byte, ) ([]model.Vulnerability, map[string]error, error)
RunCustomRegoQuery writes fileContent to a temp file and runs regoContent against it using the same OPA setup as a normal scan.
Types ¶
type Client ¶
type Client struct {
ScanParams *Parameters
ScanStartTime time.Time
Tracker *tracker.CITracker
Storage *storage.MemoryStorage
Printer *consolePrinter.Printer
FlagEvaluator featureflags.FlagEvaluator
// contains filtered or unexported fields
}
Client represents a scan client
func NewClient ¶
func NewClient(ctx context.Context, params *Parameters, customPrint *consolePrinter.Printer, opts ...ClientOption) (*Client, error)
NewClient initializes the client with all the required parameters. Optional ClientOptions (WithFS, WithQuerySourceFactory, WithInMemoryScan) configure the HTTP server's content-push path; the CLI passes none.
func (*Client) GetQueryPath ¶
GetQueryPath gets all the queries paths
func (*Client) PerformScan ¶
func (c *Client) PerformScan(ctx context.Context) (ScanMetadata, error)
PerformScan executes executeScan and postScan
type ClientOption ¶ added in v1.7.0
type ClientOption func(*Client)
ClientOption customizes a Client at construction time.
func WithFS ¶ added in v1.7.0
func WithFS(fsys vfs.FS) ClientOption
WithFS sets the filesystem used for cross-file resolution. The CLI uses the default (real disk); the HTTP server injects an in-memory FS built from pushed content. A nil fsys is ignored.
func WithInMemoryScan ¶ added in v1.7.0
func WithInMemoryScan(paths []string) ClientOption
WithInMemoryScan marks the scan as content-push: initScan builds its file set from the given paths (the keys of the pushed content) instead of walking the disk. Used together with WithFS.
func WithQuerySourceFactory ¶ added in v1.7.0
func WithQuerySourceFactory(f func(ctx context.Context, platforms []string) (source.QueriesSource, error)) ClientOption
WithQuerySourceFactory injects a factory that supplies the engine's queries, bypassing the default Datadog/filesystem source. The HTTP server uses this to serve rules pushed in the request body. Promotes the previously test-only querySourceFactory seam to a first-class production option.
type Parameters ¶
type Parameters struct {
CloudProvider []string
ExperimentalQueries bool
InputData string
OutputName string
OutputPath string
RepoPath string
Path []string
PayloadPath string
PreviewLines int
QueriesPath []string
LibrariesPath string
ReportFormats []string
Platform []string
TerraformVarsPath string
LineInfoPayload bool
DisableSecrets bool
SecretsRegexesPath string
ChangedDefaultQueryPath bool
ChangedDefaultLibrariesPath bool
ScanID string
BillOfMaterials bool
ExcludeGitIgnore bool
OpenAPIResolveReferences bool
ParallelScanFlag int
MaxFileSizeFlag int
UseOldSeverities bool
MaxResolverDepth int
PreAnalysisExcludePaths []string
SCIInfo model.SCIInfo
FlagEvaluator featureflags.FlagEvaluator
Config config.IacConfig
ShouldScanTfPlans bool
DisableRuleIsolation bool
UseRulesCache bool
EnableRemoteModules bool
RemoteModulesManifestPath string
RemoteModulesHostAllowlist []string
}
Parameters represents all available scan parameters
func GetDefaultParameters ¶
func (*Parameters) GetEffectivePlatforms ¶ added in v1.3.2
func (p *Parameters) GetEffectivePlatforms() []string
type RegoValidationError ¶ added in v1.6.0
type RegoValidationError struct {
Code string `json:"code"`
Message string `json:"message"`
StartLine int `json:"start_line"`
StartCol int `json:"start_col"`
EndLine int `json:"end_line"`
EndCol int `json:"end_col"`
}
RegoValidationError is a compile-time or static-analysis error with source location.
func ValidateCustomRegoQuery ¶ added in v1.6.0
func ValidateCustomRegoQuery( ctx context.Context, platform string, regoContent string, libSource source.QueriesSource, ) ([]RegoValidationError, error)
ValidateCustomRegoQuery runs three diagnostic phases against regoContent and returns all errors in a single call — parse errors, static AST checks, and OPA compilation errors are collected independently so no phase gates another:
- Parse: syntax errors enriched with precise locations.
- Static checks: package name, rule name, result fields, sprintf arity, missing imports.
- OPA compile against platform libraries: type errors and unresolved references.
Returns (nil, nil) on success, (errors, nil) on validation failure.
func ValidateRegoStructure ¶ added in v1.6.0
func ValidateRegoStructure(regoContent string) []RegoValidationError
ValidateRegoStructure parses regoContent and runs every static check without loading platform libraries — cheaper than ValidateCustomRegoQuery when library compilation is not needed. Does not recover from a missing package declaration; use ValidateCustomRegoQuery for full user-facing validation.
type Results ¶
type Results struct {
Results []model.Vulnerability
ExtractedPaths provider.ExtractedPath
Files model.FileMetadatas
FailedQueries map[string]error
}
Results represents a result generated by a single scan
type RuleStats ¶
type RuleStats struct {
// TimedOut contains a list of rules that timed out.
TimedOut []string
// MostExpensiveRule contains the rule that spent the most time executing during the analysis.
MostExpensiveRule RuleTiming
// SlowestRule contains the rule that spent the most time executing per file.
SlowestRule RuleTiming
}
type RuleTiming ¶
type ScanMetadata ¶
type ScanMetadata struct {
// StartTime contains the instant in which the analysis started.
StartTime time.Time
// EndTime contains the instant in which the analysis ended.
EndTime time.Time
// DiffAware contains whether the analyzer could use Diff-Aware scanning.
DiffAware bool
// CoresAvailable contains the number of cores that were available to the analyzer.
CoresAvailable int
// Stats contains statistics about the analysis.
Stats ScanStats
// RuleStats contains statistics about rules.
RuleStats RuleStats
}
type ScanStats ¶
type ScanStats struct {
// Violations contains the number of violations that were found.
Violations int
// Files contains the number of files that were analyzed.
Files int
// Rules contains the number of rules that were evaluated.
Rules int
// Duration contains the time it took to complete the analysis.
Duration time.Duration
// ViolationBreakdowns contains a breakdown of the violations by severity.
ViolationBreakdowns map[string]map[string]int
// ResourcesFound contains the number of resources that were analyzed.
ResourcesScanned int
}