scan

package
v1.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 13, 2026 License: Apache-2.0 Imports: 50 Imported by: 0

Documentation

Overview

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

Package scan implements functions and helpers to ensure the proper scan of the specified files

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ApplyPlatformFilters added in v1.3.2

func ApplyPlatformFilters(cliPlatforms, onlyPlatforms, ignorePlatforms []string) []string

ApplyPlatformFilters intersects cliPlatforms with the only/ignore lists from the IaC config, returning the set of platforms that should actually be scanned.

func RunCustomRegoQuery added in v1.6.0

func RunCustomRegoQuery(
	ctx context.Context,
	platform string,
	regoContent string,
	fileContent []byte,
) ([]model.Vulnerability, map[string]error, error)

RunCustomRegoQuery writes fileContent to a temp file and runs regoContent against it using the same OPA setup as a normal scan.

Types

type Client

type Client struct {
	ScanParams    *Parameters
	ScanStartTime time.Time
	Tracker       *tracker.CITracker
	Storage       *storage.MemoryStorage
	Printer       *consolePrinter.Printer
	FlagEvaluator featureflags.FlagEvaluator
	// contains filtered or unexported fields
}

Client represents a scan client

func NewClient

func NewClient(ctx context.Context, params *Parameters, customPrint *consolePrinter.Printer, opts ...ClientOption) (*Client, error)

NewClient initializes the client with all the required parameters. Optional ClientOptions (WithFS, WithQuerySourceFactory, WithInMemoryScan) configure the HTTP server's content-push path; the CLI passes none.

func (*Client) GetQueryPath

func (c *Client) GetQueryPath(ctx context.Context) (provider.ExtractedPath, error)

GetQueryPath gets all the queries paths

func (*Client) PerformScan

func (c *Client) PerformScan(ctx context.Context) (ScanMetadata, error)

PerformScan executes executeScan and postScan

func (*Client) Scan added in v1.7.0

func (c *Client) Scan(ctx context.Context) (*Results, error)

Scan runs the scan pipeline in memory and returns the results without writing SARIF, reading git, or calling the network. It is the entry point used by the HTTP server; the CLI uses PerformScan (which additionally produces reports).

type ClientOption added in v1.7.0

type ClientOption func(*Client)

ClientOption customizes a Client at construction time.

func WithFS added in v1.7.0

func WithFS(fsys vfs.FS) ClientOption

WithFS sets the filesystem used for cross-file resolution. The CLI uses the default (real disk); the HTTP server injects an in-memory FS built from pushed content. A nil fsys is ignored.

func WithInMemoryScan added in v1.7.0

func WithInMemoryScan(paths []string) ClientOption

WithInMemoryScan marks the scan as content-push: initScan builds its file set from the given paths (the keys of the pushed content) instead of walking the disk. Used together with WithFS.

func WithQuerySourceFactory added in v1.7.0

func WithQuerySourceFactory(f func(ctx context.Context, platforms []string) (source.QueriesSource, error)) ClientOption

WithQuerySourceFactory injects a factory that supplies the engine's queries, bypassing the default Datadog/filesystem source. The HTTP server uses this to serve rules pushed in the request body. Promotes the previously test-only querySourceFactory seam to a first-class production option.

type Parameters

type Parameters struct {
	CloudProvider               []string
	ExperimentalQueries         bool
	InputData                   string
	OutputName                  string
	OutputPath                  string
	RepoPath                    string
	Path                        []string
	PayloadPath                 string
	PreviewLines                int
	QueriesPath                 []string
	LibrariesPath               string
	ReportFormats               []string
	Platform                    []string
	TerraformVarsPath           string
	LineInfoPayload             bool
	DisableSecrets              bool
	SecretsRegexesPath          string
	ChangedDefaultQueryPath     bool
	ChangedDefaultLibrariesPath bool
	ScanID                      string
	BillOfMaterials             bool
	ExcludeGitIgnore            bool
	OpenAPIResolveReferences    bool
	ParallelScanFlag            int
	MaxFileSizeFlag             int
	UseOldSeverities            bool
	MaxResolverDepth            int
	PreAnalysisExcludePaths     []string
	SCIInfo                     model.SCIInfo
	FlagEvaluator               featureflags.FlagEvaluator
	Config                      config.IacConfig
	ShouldScanTfPlans           bool
	DisableRuleIsolation        bool
	UseRulesCache               bool
	EnableRemoteModules         bool
	RemoteModulesManifestPath   string
	RemoteModulesHostAllowlist  []string
}

Parameters represents all available scan parameters

func GetDefaultParameters

func GetDefaultParameters(ctx context.Context, rootPath string) (*Parameters, context.Context)

func (*Parameters) GetEffectivePlatforms added in v1.3.2

func (p *Parameters) GetEffectivePlatforms() []string

type RegoValidationError added in v1.6.0

type RegoValidationError struct {
	Code      string `json:"code"`
	Message   string `json:"message"`
	StartLine int    `json:"start_line"`
	StartCol  int    `json:"start_col"`
	EndLine   int    `json:"end_line"`
	EndCol    int    `json:"end_col"`
}

RegoValidationError is a compile-time or static-analysis error with source location.

func ValidateCustomRegoQuery added in v1.6.0

func ValidateCustomRegoQuery(
	ctx context.Context,
	platform string,
	regoContent string,
	libSource source.QueriesSource,
) ([]RegoValidationError, error)

ValidateCustomRegoQuery runs three diagnostic phases against regoContent and returns all errors in a single call — parse errors, static AST checks, and OPA compilation errors are collected independently so no phase gates another:

  1. Parse: syntax errors enriched with precise locations.
  2. Static checks: package name, rule name, result fields, sprintf arity, missing imports.
  3. OPA compile against platform libraries: type errors and unresolved references.

Returns (nil, nil) on success, (errors, nil) on validation failure.

func ValidateRegoStructure added in v1.6.0

func ValidateRegoStructure(regoContent string) []RegoValidationError

ValidateRegoStructure parses regoContent and runs every static check without loading platform libraries — cheaper than ValidateCustomRegoQuery when library compilation is not needed. Does not recover from a missing package declaration; use ValidateCustomRegoQuery for full user-facing validation.

type Results

type Results struct {
	Results        []model.Vulnerability
	ExtractedPaths provider.ExtractedPath
	Files          model.FileMetadatas
	FailedQueries  map[string]error
}

Results represents a result generated by a single scan

type RuleStats

type RuleStats struct {
	// TimedOut contains a list of rules that timed out.
	TimedOut []string
	// MostExpensiveRule contains the rule that spent the most time executing during the analysis.
	MostExpensiveRule RuleTiming
	// SlowestRule contains the rule that spent the most time executing per file.
	SlowestRule RuleTiming
}

type RuleTiming

type RuleTiming struct {
	Name string
	Time time.Duration
}

type ScanMetadata

type ScanMetadata struct {
	// StartTime contains the instant in which the analysis started.
	StartTime time.Time
	// EndTime contains the instant in which the analysis ended.
	EndTime time.Time
	// DiffAware contains whether the analyzer could use Diff-Aware scanning.
	DiffAware bool
	// CoresAvailable contains the number of cores that were available to the analyzer.
	CoresAvailable int
	// Stats contains statistics about the analysis.
	Stats ScanStats
	// RuleStats contains statistics about rules.
	RuleStats RuleStats
}

type ScanStats

type ScanStats struct {
	// Violations contains the number of violations that were found.
	Violations int
	// Files contains the number of files that were analyzed.
	Files int
	// Rules contains the number of rules that were evaluated.
	Rules int
	// Duration contains the time it took to complete the analysis.
	Duration time.Duration
	// ViolationBreakdowns contains a breakdown of the violations by severity.
	ViolationBreakdowns map[string]map[string]int
	// ResourcesFound contains the number of resources that were analyzed.
	ResourcesScanned int
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL