You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can choose the rules to use to scan your repository by creating a `static-analysis.datadog.yml` file.
46
+
You can choose the rules to use to scan your repository by creating a `code-security.datadog.yaml` file.
47
47
48
48
First, make sure you follow the [documentation](https://docs.datadoghq.com/code_analysis/static_analysis)
49
-
and create a `static-analysis.datadog.yml` file at the root of your project with the rulesets you want to use.
50
-
51
-
All the rules can be found on the [Datadog documentation](https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/). Your `static-analysis.datadog.yml` may only contain rulesets available from the [Datadog documentation](https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/)
49
+
and create a `code-security.datadog.yaml` file at the root of your project with the rulesets you want to use.
52
50
53
51
Example of YAML file
54
52
55
53
```yaml
56
-
schema-version: v1
57
-
rulesets:
58
-
- python-code-style
59
-
- python-best-practices
60
-
- python-inclusive
61
-
ignore:
62
-
- tests
54
+
schema-version: v1.0
55
+
sast:
56
+
use-rulesets:
57
+
- python-code-style
58
+
- python-best-practices
59
+
- python-inclusive
60
+
global-config:
61
+
ignore-paths:
62
+
- src/experiments
63
63
```
64
64
65
65
### CI/CD Integration
@@ -74,15 +74,15 @@ If you use it in your own CI/CD pipeline, you can integrate the tool directly: s
74
74
### IntelliJ JetBrains products
75
75
76
76
The [Datadog IntelliJ extension](https://plugins.jetbrains.com/plugin/19495-datadog) allows you to use the static analyzer directly from all JetBrains products.
77
-
Create a `static-analysis.datadog.yml` file, download the extension and you can start using it. You can see below an example of a suggestion to add a timeout
78
-
when fetching data with Python with the requests module.
77
+
Create a configuration file ([reference here](doc/legacy_config.md)), download the extension, and you can start using it.
78
+
You can see below an example of a suggestion to add a timeout when fetching data with Python with the requests module.
The [Datadog VS Code extension](https://marketplace.visualstudio.com/items?itemName=Datadog.datadog-vscode) allows you to use the static analyzer directly from VS Code.
85
-
Create a `static-analysis.datadog.yml` file, download the extension and you can start using it.
85
+
Create a configuration file ([reference here](doc/legacy_config.md)), download the extension, and you can start using it.
For the tool to work, you must have a `<directory>/static-analysis.datadog.yml` file that defines the configuration of the analyzer. This file will indicate the rules you will use for your project.
121
-
122
-
You can get more information about the configuration on [Datadog documentation](https://docs.datadoghq.com/security/code_security/static_analysis/setup).
123
-
124
120
### Mac OS X users
125
121
126
122
If you installed via Homebrew (`brew install datadog-static-analyzer`), you can skip this section.
@@ -151,141 +147,193 @@ Set the following variables to configure an analysis:
151
147
152
148
## Configuration file
153
149
154
-
The static analyzer can be configured using a `static-analysis.datadog.yml` file
155
-
at the root directory of the repository. This is a YAML file with the following entries:
150
+
The static analyzer can be configured using a `code-security.datadog.yaml` file at the root directory of the repository.
151
+
The file must begin with `schema-version: v1.0` and should have a `sast` object specifying the configuration.
152
+
153
+
```yaml
154
+
schema-version: v1.0
155
+
sast:
156
+
# ... configuration goes here
157
+
```
158
+
159
+
The **sast object** supports the following fields:
|`use-default-rulesets`| Boolean | Whether to enable Datadog default rulesets. |`true`|
164
+
|`use-rulesets`| Array | A list of ruleset names to enable ([custom rulesets](https://docs.datadoghq.com/security/code_security/static_analysis/custom_rules/tutorial/) or [Datadog default rulesets](https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/)). Enabled in addition to the default rulesets if `use-default-rulesets` is `true`. | None |
165
+
|`ignore-rulesets`| Array | A list of ruleset names to disable. Takes precedence over `use-rulesets` and `use-default-rulesets`. | None |
166
+
|`ruleset-configs`| Object | A map from ruleset name to its configuration. | None |
167
+
|`global-config`| Object | Global settings for the repository. | None |
168
+
169
+
### Ruleset configuration
156
170
157
-
- `rulesets`: (required) a list with all the rulesets to use for this repository (see [Datadog Documentation](https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/) for a full list). The elements of this list must be strings or maps containing a configuration for a ruleset (described below.)
158
-
- `ignore`: (optional) a list of path prefixes and glob patterns to ignore. A file that matches any of its entries will not be analyzed.
159
-
- `only`: (optional) a list of path prefixes and glob patterns to analyze. If `only` is specified, only files that match one of its entries will be analyzed.
160
-
- `ignore-gitignore`: (optional) by default, any entries found in the `.gitignore` file are added to the `ignore` list. If the `ignore-gitignore` option is true, the `.gitignore` file is not read.
161
-
- `max-file-size-kb`: (optional) files larger than this size, in kilobytes, will be ignored. The default value is 200 kB.
162
-
- `schema-version`: (optional) the version of the schema that this configuration file follows. If specified, it must be `v1`.
171
+
Each entry in the `ruleset-configs` map configures a specific ruleset. A ruleset does not need to be listed in `use-rulesets` for its configuration to apply; the configuration is used whenever the ruleset is enabled, including through `use-default-rulesets`.
163
172
164
-
The entries of the `rulesets` list must be strings that contain the name of a ruleset to enable, or a map that contains the configuration for a ruleset. This map contains the following fields:
|`only-paths`| Array | File paths or glob patterns. Only files matching these patterns are processed for this ruleset. | None |
176
+
|`ignore-paths`| Array | File paths or glob patterns to exclude from analysis for this ruleset. | None |
177
+
|`rule-configs`| Object | A map from rule name to its configuration. | None |
165
178
166
-
- the first field (required) gives the ruleset name as its key, with an empty value.
167
-
- `ignore`: (optional) a list of path prefixes and glob patterns to ignore _for this ruleset_. Rules in this ruleset will not be evaluated for any files that match any of the entries in the `ignore` list.
168
-
- `only`: (optional) a list of path prefixes and glob patterns to analyze _for this ruleset_. If `only` is specified, rules in this ruleset will only be evaluated for files that match one of the entries.
169
-
- `rules`: (optional) a map of rule configurations. Rules not specified in this map will still be evaluated, but with their default configuration.
179
+
### Rule configuration
170
180
171
-
The map in the `rules` field uses the rule's name as its key, and the values are maps with the following fields:
181
+
Each entry in the `rule-configs` map configures a specific rule:
172
182
173
-
- `ignore`(optional) a list of path prefixes and glob patterns to ignore _for this rule_. This rule will not be evaluated for any files that match any of the entries in the `ignore` list.
174
-
- `only`: (optional) a list of path prefixes and glob patterns to analyze _for this rule_. If `only` is specified, this rule will only be evaluated for files that match one of the entries.
175
-
- `severity`: (optional) if provided, override the severity of violations produced by this rule. The valid severities are `ERROR`, `WARNING`, `NOTICE`, and `NONE`.
176
-
- `category`: (optional) if provided, override this rule's category. The valid categories are `BEST_PRACTICES`, `CODE_STYLE`, `ERROR_PRONE`, `PERFORMANCE`, and `SECURITY`.
177
-
- `arguments`: (optional) a map of values for the rule's arguments.
|`only-paths`| Array | File paths or glob patterns. The rule is applied only to files matching these patterns. | None |
186
+
|`ignore-paths`| Array | File paths or glob patterns to exclude. The rule is not applied to files matching these patterns. | None |
187
+
|`arguments`| Object | Parameters and values for the rule. Values can be scalars or defined per path. | None |
188
+
|`severity`| String or Object | The rule severity. Valid values: `ERROR`, `WARNING`, `NOTICE`, `NONE`. Can be a single value or defined per path. | None |
The map in the `arguments` field uses an argument's name as its key, and the values are either strings or maps:
191
+
## Argument and severity configuration
180
192
181
-
- if you want to set a value for the whole repository, you can specify it as a string;
182
-
- if you want to set different values for different subtrees in the repository, you can specify them as a map from a subtree prefix to the value that the argument will have within that subtree. See the example for more details.
193
+
Arguments and severity can be defined in one of two formats:
194
+
195
+
1.**Single value:** Applies to the whole repository.
196
+
197
+
```yaml
198
+
arguments:
199
+
argument-name: value
200
+
severity: ERROR
201
+
```
202
+
203
+
2. **Per-path mapping:** Different values for different subtrees. The longest matching path prefix applies. Use `/` as a catch-all default.
204
+
205
+
```yaml
206
+
arguments:
207
+
argument-name:
208
+
/: value_default
209
+
path/example: value_specific
210
+
severity:
211
+
/: WARNING
212
+
path/example: ERROR
213
+
```
214
+
215
+
The `category` field takes a single string value for the whole repository.
216
+
217
+
### Global configuration
218
+
219
+
The `global-config` object controls repository-wide settings and has the following optional fields:
0 commit comments