Skip to content

Commit b03d0e8

Browse files
jasonforaljasonforal
committed
1 parent 209d0b9 commit b03d0e8

11 files changed

Lines changed: 313 additions & 52 deletions

File tree

‎schema/Makefile‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,17 @@
11
all: test
22

3-
test: test-schema-valid test-schema-invalid test-legacy-valid test-legacy-invalid test-v2-valid test-v2-invalid
3+
test: test-v1.0-schema-valid test-v1.0-schema-invalid test-legacy-valid test-legacy-invalid
44

5-
examples-valid = $(1)/examples/valid/*.yml
6-
examples-invalid = $(1)/examples/invalid/*.yml
5+
test-v1.0-schema-valid:
6+
npx --yes [email protected] test --spec=draft2020 -s sast/v1.0/validation.schema.json -r sast/v1.0/schema.json -d "tests/v1.0/valid/*.yml" --valid
77

8-
test-schema-valid:
9-
npx --yes [email protected] test -s schema.json -r legacy/schema.json -d "$(call examples-valid,legacy)" --valid
10-
11-
test-schema-invalid:
12-
npx --yes [email protected] test -s schema.json -r legacy/schema.json -d "$(call examples-invalid,legacy)" --invalid
8+
test-v1.0-schema-invalid:
9+
npx --yes [email protected] test --spec=draft2020 -s sast/v1.0/validation.schema.json -r sast/v1.0/schema.json -d "tests/v1.0/invalid/*.yml" --invalid
1310

1411
test-legacy-valid:
15-
npx --yes [email protected] test -s legacy/schema.json -d "$(call examples-valid,legacy)" --valid
12+
npx --yes [email protected] test -s legacy/schema.json -d "legacy/examples/valid/*.yml" --valid
1613

1714
test-legacy-invalid:
18-
npx --yes [email protected] test -s legacy/schema.json -d "$(call examples-invalid,legacy)" --invalid
19-
20-
test-v2-valid:
21-
npx --yes [email protected] test -s v2/schema.json -d "$(call examples-valid,v2)" --valid
22-
23-
test-v2-invalid:
24-
npx --yes [email protected] test -s v2/schema.json -d "$(call examples-invalid,v2)" --invalid
15+
npx --yes [email protected] test -s legacy/schema.json -d "legacy/examples/invalid/*.yml" --invalid
2516

26-
.PHONY: test test-schema-valid test-schema-invalid test-legacy-valid test-legacy-invalid test-v2-valid test-v2-invalid
17+
.PHONY: test test-v1.0-schema-valid test-v1.0-schema-invalid test-legacy-valid test-legacy-invalid

‎schema/sast/v1.0/schema.json‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://raw.githubusercontent.com/DataDog/schema/main/code-security/sast/v1.0/schema.json",
4+
"title": "Datadog SAST Configuration",
5+
"type": "object",
6+
"properties": {
7+
"use-default-rulesets": {
8+
"type": "boolean",
9+
"default": true,
10+
"description": "Enable Datadog's default rulesets. Defaults to true."
11+
},
12+
"use-rulesets": {
13+
"type": "array",
14+
"items": {
15+
"type": "string",
16+
"minLength": 1
17+
},
18+
"description": "List of rulesets to enable (in addition to defaults, if use-default-rulesets is true)."
19+
},
20+
"ignore-rulesets": {
21+
"type": "array",
22+
"items": {
23+
"type": "string",
24+
"minLength": 1
25+
},
26+
"description": "List of rulesets to disable. Takes precedence over default rulesets and those listed in use-rulesets."
27+
},
28+
"ruleset-configs": {
29+
"type": "object",
30+
"additionalProperties": {
31+
"$ref": "#/$defs/rulesetConfig"
32+
},
33+
"description": "Per-ruleset configurations"
34+
},
35+
"global-config": {
36+
"$ref": "#/$defs/globalConfig",
37+
"description": "Global settings for the static analyzer."
38+
}
39+
},
40+
"required": [],
41+
"additionalProperties": false,
42+
"$defs": {
43+
"globalConfig": {
44+
"type": "object",
45+
"properties": {
46+
"only-paths": {
47+
"$ref": "#/$defs/pathList"
48+
},
49+
"ignore-paths": {
50+
"$ref": "#/$defs/pathList"
51+
},
52+
"use-gitignore": {
53+
"type": "boolean",
54+
"default": true,
55+
"description": "Use .gitignore to exclude files. Defaults to true."
56+
},
57+
"ignore-generated-files": {
58+
"type": "boolean",
59+
"default": true,
60+
"description": "Ignore generated files. Defaults to true."
61+
},
62+
"max-file-size-kb": {
63+
"type": "number",
64+
"minimum": 0
65+
}
66+
},
67+
"additionalProperties": false
68+
},
69+
"rulesetConfig": {
70+
"type": "object",
71+
"properties": {
72+
"only-paths": {
73+
"$ref": "#/$defs/pathList",
74+
"description": "Paths to analyze for this ruleset."
75+
},
76+
"ignore-paths": {
77+
"$ref": "#/$defs/pathList",
78+
"description": "Paths to exclude for this ruleset."
79+
},
80+
"rule-configs": {
81+
"type": "object",
82+
"additionalProperties": {
83+
"$ref": "#/$defs/ruleConfig"
84+
},
85+
"description": "Per-rule configurations within this ruleset."
86+
}
87+
},
88+
"additionalProperties": false
89+
},
90+
"ruleConfig": {
91+
"type": "object",
92+
"properties": {
93+
"only-paths": {
94+
"$ref": "#/$defs/pathList"
95+
},
96+
"ignore-paths": {
97+
"$ref": "#/$defs/pathList"
98+
},
99+
"arguments": {
100+
"type": "object",
101+
"additionalProperties": {
102+
"$ref": "#/$defs/argumentValue"
103+
}
104+
},
105+
"severity": {
106+
"$ref": "#/$defs/severityValue"
107+
},
108+
"category": {
109+
"enum": [
110+
"BEST_PRACTICES",
111+
"CODE_STYLE",
112+
"ERROR_PRONE",
113+
"PERFORMANCE",
114+
"SECURITY"
115+
]
116+
}
117+
},
118+
"additionalProperties": false
119+
},
120+
"pathList": {
121+
"type": "array",
122+
"items": {
123+
"type": "string",
124+
"minLength": 1
125+
},
126+
"description": "List of file paths or glob patterns."
127+
},
128+
"argumentValue": {
129+
"anyOf": [
130+
{
131+
"$ref": "#/$defs/singularArgumentValue"
132+
},
133+
{
134+
"type": "object",
135+
"additionalProperties": {
136+
"$ref": "#/$defs/singularArgumentValue"
137+
}
138+
}
139+
],
140+
"description": "Argument value (singular or by-path)."
141+
},
142+
"singularArgumentValue": {
143+
"anyOf": [
144+
{
145+
"type": "string"
146+
},
147+
{
148+
"type": "number",
149+
"$comment": "will be internally coerced to string"
150+
},
151+
{
152+
"type": "boolean",
153+
"$comment": "will be internally coerced to string"
154+
}
155+
]
156+
},
157+
"severityValue": {
158+
"anyOf": [
159+
{
160+
"$ref": "#/$defs/singularSeverityValue"
161+
},
162+
{
163+
"type": "object",
164+
"additionalProperties": {
165+
"$ref": "#/$defs/singularSeverityValue"
166+
}
167+
}
168+
]
169+
},
170+
"singularSeverityValue": {
171+
"enum": [
172+
"ERROR",
173+
"WARNING",
174+
"NOTICE",
175+
"NONE"
176+
]
177+
}
178+
}
179+
}

‎schema/sast/v1.0/validation.schema.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://raw.githubusercontent.com/DataDog/schema/main/code-security/sast/v1.0/validation.schema.json",
4+
"title": "Datadog SAST Configuration Validation",
5+
"description": "Validation for v1.x",
6+
"type": "object",
7+
"required": ["schema-version"],
8+
"additionalProperties": false,
9+
"properties": {
10+
"schema-version": {
11+
"type": "string",
12+
"pattern": "^v1\\.\\d+$"
13+
},
14+
"sast": {
15+
"$ref": "https://raw.githubusercontent.com/DataDog/schema/main/code-security/sast/v1.0/schema.json"
16+
},
17+
"secrets": {},
18+
"iac": {},
19+
"sca": {},
20+
"iast": {}
21+
}
22+
}

‎schema/schema.json‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎schema/tests/v1.0/invalid/unknown-field-root.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
schema-version: v1.0
2+
3+
sast:
4+
some-field-not-defined-in-the-schema: true

‎schema/tests/v1.0/invalid/unknown-field-rule-config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
schema-version: v1.0
2+
3+
sast:
4+
ruleset-configs:
5+
java-security:
6+
rule-configs:
7+
sql-injection:
8+
some-field-not-defined-in-the-schema: true

‎schema/tests/v1.0/invalid/unknown-field-ruleset-config.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
schema-version: v1.0
2+
3+
sast:
4+
ruleset-configs:
5+
java-security:
6+
some-field-not-defined-in-the-schema: true
7+

‎schema/tests/v1.0/invalid/unknown-global-config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
schema-version: v1.0
2+
3+
sast:
4+
global-config:
5+
some-field-not-defined-in-the-schema: true

‎schema/tests/v1.0/valid/arguments.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
schema-version: v1.0
2+
3+
sast:
4+
ruleset-configs:
5+
lorem_ipsum:
6+
rule-configs:
7+
dolor:
8+
arguments:
9+
sit_amet: "20"
10+
consectetur:
11+
/: 40
12+
one/two/three/four: "80"
13+

‎schema/tests/v1.0/valid/complex.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
schema-version: v1.0
2+
3+
sast:
4+
use-default-rulesets: false
5+
use-rulesets:
6+
- java-security
7+
- python-security
8+
9+
global-config:
10+
only-paths:
11+
- src/
12+
- lib/
13+
ignore-paths:
14+
- "*/**/out/*.py"
15+
- "**/vendor/"
16+
use-gitignore: true
17+
ignore-generated-files: true
18+
max-file-size-kb: 500
19+
20+
ruleset-configs:
21+
python-security:
22+
only-paths:
23+
- "src/.py"
24+
ignore-paths:
25+
- tests/
26+
rule-configs:
27+
insecure-hash-functions:
28+
severity: ERROR
29+
arguments:
30+
ignore-functions: "md5"
31+
32+
java-best-practices:
33+
rule-configs:
34+
ssl-context:
35+
only-paths:
36+
- src/main/java/com/company/router
37+
severity: WARNING
38+

0 commit comments

Comments
 (0)