From a4406f590f0b1641a8de9a0a211580f5ca50f226 Mon Sep 17 00:00:00 2001 From: Jason Foral Date: Mon, 16 Mar 2026 11:26:18 -0400 Subject: [PATCH 1/3] Update documentation for Code Security configuration file --- content/en/ide_plugins/vscode/_index.md | 2 +- .../static_analysis/custom_rules/tutorial.md | 11 +- .../static_analysis/github_actions.md | 22 +- .../static_analysis/setup/_index.md | 522 ++++++++---------- .../code_security/troubleshooting/_index.md | 6 +- .../custom_rule_tutorial_configuration2.png | Bin 0 -> 166364 bytes .../code_security/org-level-configuration.png | Bin 0 -> 153227 bytes .../repo-level-configuration.png | Bin 0 -> 229387 bytes 8 files changed, 270 insertions(+), 293 deletions(-) create mode 100644 static/images/security/code_security/custom_rule_tutorial_configuration2.png create mode 100644 static/images/security/code_security/org-level-configuration.png create mode 100644 static/images/security/code_security/repo-level-configuration.png diff --git a/content/en/ide_plugins/vscode/_index.md b/content/en/ide_plugins/vscode/_index.md index 3b5f7f36ed2..8e55427e0de 100644 --- a/content/en/ide_plugins/vscode/_index.md +++ b/content/en/ide_plugins/vscode/_index.md @@ -242,7 +242,7 @@ Do you use [Cursor][17], or another fork of VS Code? Find the extension on the [ [7]: /tests/explorer/ [8]: /continuous_integration/static_analysis/?tab=githubactions [9]: /security/code_security/static_analysis/static_analysis_rules/ -[10]: /security/code_security/static_analysis/setup/ +[10]: https://github.com/DataDog/datadog-static-analyzer/blob/main/doc/legacy_config.md [11]: /tracing/error_tracking/exception_replay [12]: https://www.datadoghq.com/legal/eula/ [13]: https://www.datadoghq.com/legal/privacy/ diff --git a/content/en/security/code_security/static_analysis/custom_rules/tutorial.md b/content/en/security/code_security/static_analysis/custom_rules/tutorial.md index 536c9b184f4..c527f1f04a1 100644 --- a/content/en/security/code_security/static_analysis/custom_rules/tutorial.md +++ b/content/en/security/code_security/static_analysis/custom_rules/tutorial.md @@ -99,17 +99,20 @@ function visit(query, filename, code) { ## Step 3: Use the rule To use the rule, do one of the following: - - Create a `static-analysis.datadog.yaml` file at the root of your repository with the ruleset. + - Create a `code-security.datadog.yaml` file at the root of your repository with the ruleset. - Add the rule in [your settings][3], either for the org-wide or repo-level configuration. A valid configuration for using this ruleset (and no other ruleset) look like this: ```yaml -rulesets: - - tutorial +schema-version: v1.0 +sast: + use-default-rulesets: false + use-rulesets: + - tutorial ``` -{{< img src="/security/code_security/custom_rule_tutorial_configuration.png" alt="Configuration with Custom Rule" style="width:100%;" >}} +{{< img src="/security/code_security/custom_rule_tutorial_configuration2.png" alt="Configuration with Custom Rule" style="width:100%;" >}} [1]: https://app.datadoghq.com/ci/code-analysis/static-analysis/custom-rulesets [2]: https://tree-sitter.github.io/tree-sitter/using-parsers/queries/index.html diff --git a/content/en/security/code_security/static_analysis/github_actions.md b/content/en/security/code_security/static_analysis/github_actions.md index 7dfe7a1425b..1da1674b1d5 100644 --- a/content/en/security/code_security/static_analysis/github_actions.md +++ b/content/en/security/code_security/static_analysis/github_actions.md @@ -69,12 +69,15 @@ You can set the following parameters for Static Code Analysis. By default, [Datadog Static Analyzer][8] detects the languages of your codebase and uses the default rulesets to analyze your codebase. -To specify and customize the rulesets, add a `static-analysis.datadog.yml` file to your repository's root directory to define which rulesets to use. +To specify and customize the rulesets, add a `code-security.datadog.yaml` file to your repository's root directory to define which rulesets to use. ```yaml -rulesets: - - - - +schema-version: v1.0 +sast: + use-default-rulesets: false + use-rulesets: + - + - ``` Refer to the [Datadog documentation][6] for a complete list of rulesets. @@ -84,10 +87,13 @@ Refer to the [Datadog documentation][6] for a complete list of rulesets. Here is an example for Python-based repositories: ```yaml -rulesets: - - python-code-style - - python-best-practices - - python-inclusive +schema-version: v1.0 +sast: + use-default-rulesets: false + use-rulesets: + - python-code-style + - python-best-practices + - python-inclusive ``` diff --git a/content/en/security/code_security/static_analysis/setup/_index.md b/content/en/security/code_security/static_analysis/setup/_index.md index cd07c611f78..bdc565dd1ba 100644 --- a/content/en/security/code_security/static_analysis/setup/_index.md +++ b/content/en/security/code_security/static_analysis/setup/_index.md @@ -104,385 +104,352 @@ There are three levels of configuration: * Repository-level configuration (Datadog) * Repository-level configuration (Repo File) -
-By default, when no configuration is defined at the org or repo level, Datadog uses a default configuration with all default rules enabled. If you define an org-level configuration without default rules, default rules are not used. If want to use default rules in this scenario, you must enable them. -
+All three locations use the same YAML format for configuration. These configurations are merged **in order** (see [how configurations interact](#how-org-level-repo-level-and-file-level-settings-interact) below). -All three locations use the same YAML format for configuration. These configurations are merged **in order** using an overlay/patch merge method. +#### Default rulesets -#### Default rulesets (baseline configuration) +By default, Datadog's default rulesets are enabled for your repository's programming language(s) (`use-default-rulesets` is `true`). You can customize which rulesets are active: -All three configuration methods described below customize the **same default rulesets**. -Use the configuration file below as your baseline when configuring rules at the Org level, Repo level, or through a Repo file. +- To **add** rulesets beyond the defaults, list them under `use-rulesets`. +- To **disable** specific rulesets, list them under `ignore-rulesets`. +- To **disable all defaults** and choose your own, set `use-default-rulesets: false` and list the desired rulesets under `use-rulesets`. -You can paste and edit the YAML content below directly into: +For the full list of default rulesets, see [Static Code Analysis (SAST) Rules][6]. -- **Org-level configuration (Datadog)** -- **Repository-level configuration (Datadog)** +#### How org-level, repo-level, and file-level settings interact -or create the file: +All configuration levels use the same YAML format. These configurations are merged in order, with the following precedence (highest to lowest): -- **`static-analysis.datadog.yaml`** in the root of your repository (required only for the *Repository-level configuration file* option). +1. **Repo-level file** (`code-security.datadog.yaml`) +2. **Repo-level (Datadog)** +3. **Org-level (Datadog)** -To customize rulesets, **remove any rulesets you do not want to apply**: +The merge follows these rules: -```yaml -schema-version: v1 -rulesets: - - apex-code-style - - apex-security - - csharp-best-practices - - csharp-code-style - - csharp-security - - csharp-inclusive - - docker-best-practices - - github-actions - - go-best-practices - - go-inclusive - - go-security - - java-best-practices - - java-code-style - - java-security - - javascript-best-practices - - javascript-browser-security - - javascript-code-style - - javascript-inclusive - - javascript-common-security - - javascript-express - - javascript-node-security - - jsx-react - - kotlin-security - - kotlin-inclusive - - kotlin-code-style - - kotlin-best-practices - - php-best-practices - - php-security - - python-best-practices - - python-code-style - - python-django - - python-flask - - python-inclusive - - python-pandas - - python-security - - ruby-code-style - - ruby-security - - ruby-best-practices - - rails-best-practices - - swift-code-style - - swift-security - - swift-inclusive - - tsx-react - - typescript-best-practices - - typescript-browser-security - - typescript-code-style - - typescript-common-security - - typescript-express - - typescript-inclusive - - typescript-node-security -```` - -#### How org-level, repo-level, and file-level settings interact +- **Lists** (`use-rulesets`, `ignore-rulesets`, `ignore-paths`, `only-paths`): concatenated with duplicates removed. +- **Scalar values** (`use-default-rulesets`, `use-gitignore`, `ignore-generated-files`, `max-file-size-kb`, `category`, and per-path entries for `severity` and `arguments`): the highest-precedence configuration's value wins. +- **Maps** (`ruleset-configs`, `rule-configs`, `arguments`): recursively merged. -All configuration levels use the same YAML format. These configurations are merged in order using an **overlay/patch merge method**. +For example, consider the following two configurations: -For example, consider the following two YAML files: - -**File 1:** +**Org-level:** ```yaml -rulesets: - - A - rules: - foo: - ignore: ["**"] - args: ["my_arg1", "my_arg2"] +schema-version: v1.0 +sast: + use-default-rulesets: false + use-rulesets: + - A + ruleset-configs: + A: + rule-configs: + foo: + ignore-paths: + - "path/to/ignore" + arguments: + maxCount: 10 ``` -**File 2:** +**Repo-level:** ```yaml -rulesets: - - A - rules: +schema-version: v1.0 +sast: + use-rulesets: + - B + ignore-rulesets: + - C + ruleset-configs: + A: + rule-configs: foo: - ignore: ["my_ignored_file.file"] + arguments: + maxCount: 22 bar: - only: ["the_only_file.file"] - - B - + only-paths: + - "src" ``` -If these YAML files were merged in order (first File 1, then File 2), the result would be: +The merged result would be: ```yaml -rulesets: - - A - rules: +schema-version: v1.0 +sast: + use-default-rulesets: false + use-rulesets: + - A + - B + ignore-rulesets: + - C + ruleset-configs: + A: + rule-configs: foo: - ignore: ["my_ignored_file.file"] - args: ["my_arg1", "my_arg2"] + ignore-paths: + - "path/to/ignore" + arguments: + maxCount: 22 bar: - only: ["the_only_file.file"] - - B - - + only-paths: + - "src" ``` -As you can see, the `ignore: ["**"]` from File 1 was **overlayed** by the `ignore: ["my_ignored_file.file"]` value from File 2 due to merge order. This happened because there was a conflict and the second file's value took precedence due to merge order. The `args` field from File 1 is retained because the second file does not override it. +As you can see, the `maxCount: 10` argument from the org-level configuration was **overlayed** by the `maxCount: 22` value from the repo-level configuration due to merge order. This happened because there was a conflict and the repo-level configuration's value took precedence due to merge order. All other fields from the org-level configuration are retained because the repo-level configuration does not override them. #### Org level configuration -{{< img src="/security/code_security/org-wide-configuration2.png" alt="Rule created" style="width:100%;" >}} +{{< img src="/security/code_security/org-level-configuration.png" alt="Org level configuration UI" style="width:100%;" >}} Configurations at the org level apply to all repositories that are being analyzed and is a good place to define rules that must run or global paths/files to be ignored. #### Repository level configuration -{{< img src="/security/code_security/org-wide-configuration2.png" alt="Rule created" style="width:100%;" >}} +{{< img src="/security/code_security/repo-level-configuration.png" alt="Repo level configuration UI" style="width:100%;" >}} Configurations at the repository level apply only to the repository selected. These configurations are merged with the org configuration, with the repository configuration taking precedence. Repository level configurations are a good place to define overrides for repository specific details, or add rules that are specific to only that repo for example. #### Repository level configuration (file) -In addition to the configurations provided for the Org and Repository level, you can also define a configuration at the root of your repo in the form of ``static-analysis.datadog.yml``. This file takes precedence over the Repository level configuration defined in Datadog. Repository level file configurations are a useful method to change rule configs and iterate on setup and testing. +In addition to the configurations provided for the Org and Repository level, you can also define a configuration at the root of your repo in the form of ``code-security.datadog.yaml``. This file takes precedence over the Repository level configuration defined in Datadog. Repository level file configurations are a useful method to change rule configs and iterate on setup and testing. ### Configuration format The following configuration format applies to all configuration locations: Org level, Repository level, and Repository level (file). -The full structure of a configuration is as follows: +The configuration file must begin with `schema-version: v1.0`, followed by a `sast` key containing the analysis configuration. The full structure is as follows: ```yaml -rulesets: - - ruleset-name # A ruleset we want to run with default configurations - - ruleset-name: - # Only apply this ruleset to the following paths/files - only: - - "path/example" - - "**/*.file" - # Do not apply this ruleset in the following paths/files - ignore: +schema-version: v1.0 +sast: + use-default-rulesets: true + use-rulesets: + - ruleset-name + ignore-rulesets: + # Always ignore these rulesets (even if it is a default ruleset or listed in `use-rulesets`) + - ignored-ruleset-name + ruleset-configs: + ruleset-name: + # Only apply this ruleset to the following paths/files + only-paths: + - "path/example" + - "**/*.file" + # Do not apply this ruleset in the following paths/files + ignore-paths: + - "path/example/directory" + - "**/config.file" + rule-configs: + rule-name: + # Only apply this rule to the following paths/files + only-paths: + - "path/example" + - "**/*.file" + # Do not apply this rule to the following paths/files + ignore-paths: + - "path/example/directory" + - "**/config.file" + arguments: + # Set the rule's argument to value. + argument-name: value + severity: ERROR + category: CODE_STYLE + rule-name: + arguments: + # Set different argument values in different subtrees + argument-name: + # Set the rule's argument to value_1 by default (root path of the repo) + /: value_1 + # Set the rule's argument to value_2 for specific paths + path/example: value_2 + global-config: + # Only analyze the following paths/files + only-paths: - "path/example" - "**/*.file" - - ruleset-name: - rules: - rule-name: - # Only apply this rule to the following paths/files - only: - - "path/example" - - "**/*.file" - # Do not apply this rule to the following paths/files - ignore: - - "path/example" - - "**/*.file" - arguments: - # Set the rule's argument to value. - argument-name: value - rule-name: - arguments: - # Set different argument values in different subtrees - argument-name: - # Set the rule's argument to value_1 by default (root path of the repo) - /: value_1 - # Set the rule's argument to value_2 for specific paths - path/example: value_2 -# Only analyze any ruleset in the following paths/files -only: - - "path/example" - - "**/*.file" -# Do not analyze any ruleset in the following paths/files -ignore: - - "path/example" - - "**/*.file" + # Do not analyze the following paths/files + ignore-paths: + - "path/example/directory" + - "**/config.file" + use-gitignore: true + ignore-generated-files: true + max-file-size-kb: 200 ``` +The `sast` key supports the following fields: - - -The YAML configuration file supports the following top-level keys: - -| **Property** | **Type** | **Description** | **Default** | -| ------------------ | -------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ----------------- | -| `rulesets` | Array | A list of rulesets to analyze. Each element can be either a ruleset name (string) or an object with detailed configuration. | *Required* | -| `only` | Array | A list of file paths or glob patterns. If provided, only matching files are analyzed across all rulesets. | None | -| `ignore` | Array | A list of file paths or glob patterns to exclude from analysis across all rulesets. | None | - -*Note:* The `only` and `ignore` keys here act as file filters that apply to the entire configuration file. +| **Property** | **Type** | **Description** | **Default** | +| --- | --- | --- | --- | +| `use-default-rulesets` | Boolean | Enable Datadog's default rulesets. | `true` | +| `use-rulesets` | Array | A list of ruleset names to enable. | None | +| `ignore-rulesets` | Array | A list of ruleset names to disable. Takes precedence over `use-rulesets` and `use-default-rulesets`. | None | +| `ruleset-configs` | Object | A map from ruleset name to its configuration. | None | +| `global-config` | Object | Global settings for the repository. | None | --- ## Ruleset configuration -Each entry in the `rulesets` array can be defined in one of two ways: +Each entry in the `ruleset-configs` map configures a specific ruleset. A ruleset does not need to appear in `use-rulesets` to have a configuration; the configuration is applied whenever that ruleset is enabled (including through `use-default-rulesets`). -1. **Simple Ruleset Declaration:** A plain string (for example, `ruleset-name`) indicates that the ruleset should run with its default settings. -2. **Detailed Ruleset Object:** An object where the key is the ruleset name and the value is an object containing additional configuration. The available properties for a detailed ruleset are: - -| **Property** | **Type** | **Description** | **Default** | -| ------------------ | -------------- | --------------------------------------------------------------------------------------------------- | ----------------- | -| `only` | Array | File paths or glob patterns. Only files matching these patterns will be processed for this ruleset. | None | -| `ignore` | Array | File paths or glob patterns to exclude from analysis for this ruleset. | None | -| `rules` | Object | A mapping of individual rule names to their configuration objects. | None | +| **Property** | **Type** | **Description** | **Default** | +| --- | --- | --- | --- | +| `only-paths` | Array | File paths or glob patterns. Only files matching these patterns will be processed for this ruleset. | None | +| `ignore-paths` | Array | File paths or glob patterns to exclude from analysis for this ruleset. | None | +| `rule-configs` | Object | A map from rule name to its configuration. | None | --- ## Rule configuration -Within a ruleset's `rules` property, each rule is defined by its name and configuration. The properties available for each rule are: +Each entry in a ruleset's `rule-configs` map configures a specific rule: -| **Property** | **Type** | **Description** | **Default** | -| ------------------ | -------------- | -------------------------------------------------------------------------------------------------- | ----------------- | -| `only` | Array | File paths or glob patterns. The rule will only be applied to files matching these patterns. | None | -| `ignore` | Array | File paths or glob patterns to exclude from the rule's application. | None | -| `arguments` | Object | Parameters and values for the rule. Values can be scalars or specified on a per-path basis. | None | +| **Property** | **Type** | **Description** | **Default** | +| --- | --- | --- | --- | +| `only-paths` | Array | File paths or glob patterns. The rule is only applied to files matching these patterns. | None | +| `ignore-paths` | Array | File paths or glob patterns to exclude from the rule. | None | +| `arguments` | Object | Parameters and values for the rule. Values can be scalars or specified on a per-path basis. | None | +| `severity` | String or Object | Override the rule's severity. Valid values: `ERROR`, `WARNING`, `NOTICE`, `NONE`. Can be a single value or a per-path map. | None | +| `category` | String | Override the rule's category. Valid values: `BEST_PRACTICES`, `CODE_STYLE`, `ERROR_PRONE`, `PERFORMANCE`, `SECURITY`. | None | --- -## Argument configuration +## Argument and severity configuration -Rule arguments can be defined in one of two formats: +Arguments and severity can be defined in one of two formats: -1. **Static Value:** Directly assign a value to an argument. +1. **Single value:** Applies to the whole repository. ```yaml arguments: argument-name: value + severity: ERROR ``` -2. **Path-Specific Mapping:** - Define different values based on file paths. Use the special key `/` to denote the default value (applicable at the repository root). + +2. **Per-path mapping:** Different values for different subtrees. The longest matching path prefix applies. Use `/` as a catch-all default. ```yaml arguments: argument-name: /: value_default path/example: value_specific + severity: + /: WARNING + path/example: ERROR ``` -| **Key** | **Type** | **Description** | **Default** | -| ----------------- | -------------- | ------------------------------------------------------------------------- | ----------------- | -| `/` | Any | The default argument value when no specific path is matched. | None | -| `specific path` | Any | The argument value for files matching the specified path or glob pattern. | None | +| **Key** | **Type** | **Description** | **Default** | +| --- | --- | --- | --- | +| `/` | Any | The default value when no specific path is matched. | None | +| `specific path` | Any | The value for files matching the specified path or glob pattern. | None | + +The `category` field takes a single string value for the whole repository. --- +## Global configuration + +The `global-config` object controls repository-wide settings: +| **Property** | **Type** | **Description** | **Default** | +| --- | --- | --- | --- | +| `only-paths` | Array | File paths or glob patterns. Only matching files are analyzed. | None | +| `ignore-paths` | Array | File paths or glob patterns to exclude from analysis. | None | +| `use-gitignore` | Boolean | Append entries from the `.gitignore` file to the `ignore-paths` list. | `true` | +| `ignore-generated-files` | Boolean | Append glob patterns for commonly-generated files to the `ignore-paths` list. | `true` | +| `max-file-size-kb` | Number | Ignore files larger than this size (in kB). | `200` | + +--- Example configuration: ```yaml -rulesets: - - python-best-practices - - python-security - - python-code-style: - rules: - max-function-lines: - # Do not apply the rule max-function-lines to the following files - ignore: - - "src/main/util/process.py" - - "src/main/util/datetime.py" - arguments: - # Set the max-function-lines rule's threshold to 150 lines - max-lines: 150 - # Override this rule's severity - severity: NOTICE - max-class-lines: - arguments: - # Set different thresholds for the max-class-lines rule in different subtrees - max-lines: - # Set the rule's threshold to 200 lines by default (root path of the repo) - /: 200 - # Set the rule's threshold to 100 lines in src/main/backend - src/main/backend: 100 - # Override this rule's severity with different values in different subtrees - severity: - # Set the rule's severity to INFO by default - /: INFO - # Set the rule's severity to NONE in tests/ - tests: NONE - - python-inclusive - - python-django: - # Only apply the python-django ruleset to the following paths - only: - - "src/main/backend" - - "src/main/django" - # Do not apply the python-django ruleset in files matching the following pattern - ignore: - - "src/main/backend/util/*.py" -# Only analyze source files -only: - - "src/main" - - "src/tests" - - "**/*.py" -# Do not analyze third-party or generated files -ignore: - - "lib/third_party" - - "**/*.generated.py" - - "**/*.pb.py" +schema-version: v1.0 +sast: + use-default-rulesets: false + use-rulesets: + - python-best-practices + - python-security + - python-code-style + - python-inclusive + - python-django + - custom-python-ruleset + ruleset-configs: + python-code-style: + rule-configs: + max-function-lines: + # Do not apply the rule max-function-lines to the following files + ignore-paths: + - "src/main/util/process.py" + - "src/main/util/datetime.py" + arguments: + # Set the max-function-lines rule's threshold to 150 lines + max-lines: 150 + # Override this rule's severity + severity: NOTICE + max-class-lines: + arguments: + # Set different thresholds for the max-class-lines rule in different subtrees + max-lines: + # Set the rule's threshold to 200 lines by default (root path of the repo) + /: 200 + # Set the rule's threshold to 100 lines in src/main/backend + src/main/backend: 100 + # Override this rule's severity with different values in different subtrees + severity: + # Set the rule's severity to NOTICE by default + /: NOTICE + # Set the rule's severity to NONE in tests/ + tests: NONE + python-django: + # Only apply the python-django ruleset to the following paths + only-paths: + - "src/main/backend" + - "src/main/django" + # Do not apply the python-django ruleset in files matching the following pattern + ignore-paths: + - "src/main/backend/util/*.py" + global-config: + # Only analyze source files + only-paths: + - "src/main" + - "src/tests" + - "**/*.py" + # Do not analyze third-party files + ignore-paths: + - "lib/third_party" ``` +## Legacy configuration +Datadog Static Code Analysis (SAST) configuration used to use a different file (``static-analysis.datadog.yml``) and a different schema. This schema has been deprecated and will not receive new updates, though it remains [documented][25] in the `datadog-static-analyzer` repository. If present, a ``code-security.datadog.yaml`` will always take precedence over ``static-analysis.datadog.yml``. -| Name | Description | Required | Default | -| -------------------- | ------------------------------------------------------------------------------------------- | --------- | --------- | -| `rulesets` | A list of ruleset names and configurations.[View all available rulesets][6]. | `true` | | -| `ignore` | A list of path prefixes and glob patterns to ignore. Matching files will not be analyzed. | `false` | | -| `only` | A list of path prefixes and glob patterns to analyze. Only matching files will be analyzed. | `false` | | -| `ignore-gitignore` | Do not use paths listed in the `.gitignore` file to skip analysis on certain files. | `false` | `false` | -| `max-file-size-kb` | Ignore files larger than the specified size (in kB units). | `false` | `200` | - -You can include the following **ruleset** options in the `static-analysis.datadog.yml` file: - -| Name | Description | Required | -| ---------- | --------------------------------------------------------------------------------------------------------------------- | --------- | -| `rules` | A list of rule configurations for rules belonging to ruleset. | `false` | -| `ignore` | A list of path prefixes and glob patterns to ignore for this specific ruleset. Matching files will not be analyzed. | `false` | -| `only` | A list of path prefixes and glob patterns to analyze for this specific ruleset. Only matching files will be analyzed. | `false` | - -You can include the following **rule** options in the `static-analysis.datadog.yml` file: - -| Name | Description | Required | -| ------------- | ------------------------------------------------------------------------------------------------------------------ | --------- | -| `ignore` | A list of path prefixes and glob patterns to ignore for this specific rule. Matching files will not be analyzed. | `false` | -| `only` | A list of path prefixes and glob patterns to analyze for this specific rule. Only matching files will be analyzed. | `false` | -| `arguments` | A map of values for rules that support customizable arguments. See the syntax below. | `false` | -| `severity` | Override the rule's severity. See the syntax below. | `false` | -| `category` | Override the rule's category. See the syntax below. | `false` | - -The map in the `arguments` field uses an argument's name as its key, and the values are either strings or maps: - -* To set a value for the whole repository, you can specify it as a string. -* To set different values for different subtrees in the repository, you can specify them as a map from a subtree prefix to the value that the argument will have within that subtree. - -The `severity` field can take a string or a map: - -* To set the severity for the whole repository, specify it as one of the following strings: `ERROR`, `WARNING`, `NOTICE`, or `NONE`. -* To set different severities for different subtrees in the repository, you can specify them as a map from a subtree prefix to the severity for that subtree. - -The `category` field can take a string with one of the following values: `BEST_PRACTICES`, `CODE_STYLE`, `ERROR_PRONE`, `PERFORMANCE`, or `SECURITY`. You can only specify one category for the whole repository. ### Ignoring violations #### Ignore for a repository -Add an ignore rule in your `static-analysis.datadog.yml` file. The example below ignores the rule `javascript-express/reduce-server-fingerprinting` for all directories. +Add a rule configuration in your `code-security.datadog.yaml` file. The example below ignores the rule `javascript-express/reduce-server-fingerprinting` for all directories. -``` -rulesets: - - javascript-express: - rules: - reduce-server-fingerprinting: - ignore: - - "**" +```yaml +schema-version: v1.0 +sast: + ruleset-configs: + javascript-express: + rule-configs: + reduce-server-fingerprinting: + ignore-paths: + - "**" ``` #### Ignore for a file or directory -Add an ignore rule in your `static-analysis.datadog.yml` file. The example below ignores the rule `javascript-express/reduce-server-fingerprinting` for this file. For more information on how to ignore by path, see the [Customize your configuration section](#customize-your-configuration). +Add a rule configuration in your `code-security.datadog.yaml` file. The example below ignores the rule `javascript-express/reduce-server-fingerprinting` for a specific file. For more information on how to ignore by path, see the [Customize your configuration section](#customize-your-configuration). -``` -rulesets: - - javascript-express: - rules: - reduce-server-fingerprinting: - ignore: - - "ad-server/src/app.js" +```yaml +schema-version: v1.0 +sast: + ruleset-configs: + javascript-express: + rule-configs: + reduce-server-fingerprinting: + ignore-paths: + - "ad-server/src/app.js" ``` #### Ignore for a specific instance @@ -685,6 +652,7 @@ Datadog stores findings in accordance with our [Data Rentention Periods](https:/ [20]: /security/code_security/static_analysis/setup/?tab=gitlab#select-your-source-code-management-provider [22]: https://docs.datadoghq.com/internal_developer_portal/software_catalog/entity_model/?tab=v30#migrating-to-v30 [24]: https://docs.datadoghq.com/account_management/teams/ +[25]: https://github.com/DataDog/datadog-static-analyzer/blob/main/doc/legacy_config.md [101]: https://docs.datadoghq.com/software_catalog/service_definitions/v3-0/ [102]: https://docs.datadoghq.com/internal_developer_portal/software_catalog/entity_model/?tab=v30#codelocations [103]: https://docs.datadoghq.com/data_security/data_retention_periods/ diff --git a/content/en/security/code_security/troubleshooting/_index.md b/content/en/security/code_security/troubleshooting/_index.md index 23293cb5923..59a13985836 100644 --- a/content/en/security/code_security/troubleshooting/_index.md +++ b/content/en/security/code_security/troubleshooting/_index.md @@ -11,7 +11,7 @@ If you experience issues setting up or configuring Datadog Code Security, use th For issues with the Datadog static analyzer, include the following information in a bug report to Datadog Support. -- Your `static-analysis.datadog.yml` file +- Your `code-security.datadog.yaml` (or legacy `static-analysis.datadog.yml`) file - The output of your static analysis tool (such as a CLI) that is run locally or in a CI/CD pipeline - The SARIF file produced (if there are any available) - The URL of your repository (public or private) @@ -24,7 +24,7 @@ If you are experiencing performance issues, you can enable the `--performance-st For performance issues, include the following information: -- Your `static-analysis.datadog.yml` file +- Your `code-security.datadog.yaml` (or legacy `static-analysis.datadog.yml`) file - The output of your static analysis tool (such as a CLI) that is run locally or in a CI/CD pipeline - The URL of your repository (public or private) @@ -76,7 +76,7 @@ is too large, consider the following options: - Update your configuration to scan only specific directories. - Configure the analyzer to run only the rulesets necessary for your codebase. -Updating the configuration is done either in the Datadog application or using the `static-analysis.datadog.yml` file. +Updating the configuration is done either in the Datadog application or using the `code-security.datadog.yaml` file. ### `GLIBC_X.YY not found` error message diff --git a/static/images/security/code_security/custom_rule_tutorial_configuration2.png b/static/images/security/code_security/custom_rule_tutorial_configuration2.png new file mode 100644 index 0000000000000000000000000000000000000000..c31240074089e9dafe1e7c0ad6dc68ca7e11c8f5 GIT binary patch literal 166364 zcmeFZWmp_f);^3Ufe=B16D+}ly9EgD?!jencLF51ySv)}gF69&1((4|f;$ZEZ}Z!I zcK6!n*-gH^U;c0n)6-owU3I$Z$bIfZu)M4oIx0RY92^|Fgt&+z9Ngm=I5?!Z$0)!V z_KMmbI5^Y_b75h531MMUd3zfZb4z15IPu{4#7D|Xvp4}Gty`~s1vlAFs9KSuFx)p= zXCF&E&hCEkm`pvo^Cck~4Ov#iX3-}z? z_!DbcNL}GGR?y)OtYZ^bgOJ!lJelN(;E0nCGjMRc!95s9aHJaK-1LbY#yEdlp08BmVK06b-<+%-zz**cSTs^%dwxl{nb1!Joc}aMV^JTxAKAND zPDp;8k>2&nPO;=IDF&WOG@nOw8>{$$-|A?k#=1knN+FjD;R}|*UCV=Rjp5-SgJI^t zHB5@3*q8XcgVde^=1&Cz@%RQ8ESHNkaOlJ1hEvI4Cf}K*Sk?SF`972s+9!|STo#Yn zLDB{z(c`BRh_P95SLmlie~E8tHX!(b8{Ka6uA`D~7w0aex0<<%$Kc1kJ`PQdV82_p zH|doEt=M{bZWtKk9epKa+|vFUW^2yN(WO^ny756`c}VEl#zOPYaXx87yjH|TZY06gtL({Hz(eOd{UYRzz50nv z9&t{PBnb{Jk6r8sDsOZMqR^`#lqVmVKKd(1JrVhcrw%{uXCRMS_lYPAV;A|lQ{NVg z)fdMWKkZRs2b(SC0&=7;(uqIxBa$c5$_u2Qq|72;CP|6CO))AHaxsI=UR-im1D^ja}TgTfZB-*cM-`^bQIsc} zq)~oSLa5?zAy}K;Bww$9G5Kzr1wXVP$J`99hL#(S$loLvGFm!HFc!brwQ1t`=8C-u zm(TAm;I$zu)A}pirOet7E^(G_-Wja{b~tu&h^I&OY%#tR6q(IB@wC|N|Ew< z1#M!tIaiedIRT|8TDc;*5-ZVEW#$EV#Tr?SddE%cMG18Y?FsUr#A)PmeJf)txjojs zy*bm`K*u8PeQwY6J?;%h-LW{cr8*Q7L z?$4IL^ka+_4efieK$09X9E(=&6HnP4-bt~QGB@i#OXW#99&$-N|K9c8A>&Pw8p}Z& za=)K`G)Tc_3{-51XQ^Q}YjF8(po3=2qEsbuiUag$=jjgObfguQC4v>I)tu$hY|3o4 zRjK8{O!VH(uIha4Tx%^y{l?rumCp}Br^j~c2ctg^r^fmfR%d>2t{VM_TUFk3%&ZW9 zUTBl2=lqS+gA44;zjrg+Ge+5)-@nGFh6Z(nazi^Wza2LoKmUHxaSbtFtHH3 z;NzU=y6IlYYr&i0vF%~c``rE6J83-gF!C@C-DzDiaICK362lU0>%5md{~bRi|6&_z z8&g|++sMtyjjQ*mH~HPOJLJ1P_@qx+pUUCSlQpH;AqiXR1an2!TiemS}Dm7O!X?TRlP4|6XaOFV_{`1^Ma|+VSDDn6hX~SWU3@%UNvEa7_#q z+*77GT6c$&l~=K^?4-rYw0FPG%*|ABW;RrFO0=ll3|xSoY(KgAJT0PaVEL=Fdknb^ z&6#dfZ?m$}^=GT-w@?_4jz(DIOTjmN(iyFK@6t1e-Aao`dtUCRN(tUp zFK=%$bGpaBXA6X4KnuXPt)oqqWrtl&4Ng{~nxdePEAPYm>^Ai}b!AVV)}5#hp)Wl2s-HK}r`L8&+F)f~FF{p*DxnN%G4mfK6a4Q?YiyEvT*9$I{L#0;^F zgN!@#IMwBDJXRk4XU};Ob{iC}_1awC*cG}K=8-kzI3;#g&^J@jDA69Mx~Z_Kf>dpa zi06l9y+Dy083C=D9#ZGtm&y0X{$6+2DWEWmfpf$2jeQ?C(lbFQH~YSlb3|SdT3J<^%|MG5)ZL#FVv=~Ag2ut;DSj#3 z5fhOdY43Oyykgv|^YAQmmw3lx=E%%t%=WmjT}yI@YWG%c655Hl%RQR5!^V?`OoL5B zhh;Mc1vusyEJ^rBc$T46c`HX>F3?=K$+?>uQFK~7`wzyyFnoYE4q7M5>De{fZ`0gb z46^lthM+_hnKz3+&tn%O7Kb>}tZSAW+h(U(+BbITBegbct{2)I1Kl>}7Dt=;&JFhY z8rl!rR^c}~e{_Wf+K{aA*qKiF|m{bWI;M{NRZwd~i% zm;5~~4XawDY)cjH3ujskLPxVOTofi;))LaEhK~j98SG~30-dbB_uVXf7d5Zb2gjV@ zzVg8znrG?@izFPUjpgvcTbjN(oz-=1vdLr~cnQ}6YcbgM_c(9YM7+~y;k$Klx_3Yt zFY_U|M-Hfbs>>#jU<){~3C8LYCNeT`G{Es=IAnMXI7HwG9{7cW$A?4y>lhAB5}x26 z$BOW8|K0`x4ld9f4(ac0G=cYrpD5r3^#1!hVoU(sBj6JT@cNvE@IS2|$7CV?&oNRQ za1BmKNmxPxcvmvCH#W9*Ftc&ghxqUTC!W}fYdFBc;ZQ!j;3X6(4&mSsX3dq=9o1!| zxeaZs81#*742&6EtsdqB_^Gbkz@e3~qduvtm8G=9XWTbyJaRl*^ zsmsWd3ftHlld?0sV|Yi#k4j2P%4=_A!mTLs;qTpnPkdx%j*hn6jEpWWE(|U#3^w+r zj7(fyT#WCS8JU^sffn=*Zq|s@6|W3adPA% zBYU{fKYso;PGeW|f8NR3;qTJ|Cdl}3g^`Kj9pnGi&C%TCKXiMz^0#h(&FgQs<9+xt zZh3Q8V@q`rb1Oj9z|i=anYdVa|GLlry7bSH{;jKugR#A^jTO+-k^i3$>+hZa_2R#G z{Og_?|GXy?69@CZ-t%8B{Y%$}NpLF~JJ?t{JqS_7+T4*J==Oh|{`X!Q|Ln%k#0t#s zuTKAZ_TPJ`|DQen_3Xd*kh3=j1fl;hG=8SP-{D`+{k=UeCh|mc@(21@v8d00qBbUaM=9AAi8*UNv>FLRfw|k4xM#~;= zde}-IBf}%T5QO{vAJSR0Jn1t8IMPpW2#^2Z&ntKY3D?(u(D1J&|F8A`mg@hL$^Vnd z|L;4^H;%`J#2?}J`r+>?M56IPut7vb`}3c6Ax%b0Dz|Ts|O>`QN0Esh8jeNx~_82itxg*}1<_8lH zp%hkg3Wow|44f2E`;7r=YQ?-m%U^YE)?HLw4rgUr>EQTzn_>oPrIaKhz0}2R*$iIF z=JUN+uj}W1V}@_aR-Q!5@3_J?hRAzDaqI{-2I6U}4W=@!Z@tPlxm4)%rlC|yrXENR z=}L9@fd2GHI2}N3AwlM9G}LQ7Mp2mShevikc`K5k~>FtCTa5(VjIHO2$iCmnzU# z7g!4aiP?}qrBEmBuUdJt+M8K8pa*Y#cisYqENHft_vgU9f{@j#`EiNySX2BQT2(QJM^O#JaHtRs}LC@<42UpaX`mm(52d8w`LZ? z^+k{XKF|!73ns#hB^!}rkQ^37QL*EmS!s#~8;G7_Nng5L%i^8iMxK?-JB)q(;#Y0E zV^q#+GcI2+l3`ksS!IcaP4{EAyNsk>7fcd<^ObH{W5*dm!jncJ_a0slgJnp zQAXDhI_m{3M2~aeG4MH~IOG@_U5{c2IUV~3c&p}TEIxhGsnBhuS)sal+YZ(?R+Gp^ zxXjNw?Tg}1-(7U+Kyuz}K=an3X+GbLz4LMx{}zUqc9wyLzZ%7ErP*kKTtvv@tbL}L zELcNWl~DLS&5+rfcXWlnKa&w`s%FX;8h=FI9xvLZCy~qy`%X1ybN96e=8vszm}nr1 zDp5uDW$h#xLd6s8rOoAFRG-?ww=onuZ=`5fdSgRrv#+f?HP(uvi`Y|{^Jy)GjZT_D zr-|a_#&G{naxs}tQ7D@&*JF>}&W?oEuePmARLUumSxjT{RXc{}P6>uG=IbpOC_`}B zPTlEGxtnl?oO64iY?A3TwX8*2^D{f3^~5cR(Z}VbipBJ`E!EK|ofHmhGe%h0?{5kRTm^5sgx*Jkm_*P9oJHCa`SM0K(s*N9i0H_iA4~zD8VjL$qL<8P!w}D zF&@FGfsIdWxsEEC(G%$0Cu~o_x*IKX-|(@C8q&zm(BTOf%FH8-F2N z6e7jT=NbiEu%7scI7F(LD@m!t1`o&Mf}G*~jkWGhBAV3s#S;> z2feMoT_&pM>J$->OQpt_Uezr4o@AxU<`7}>F8kj%(*Na*+CosfL8Sd|v|2&wZo-AE z#X84zSvpQ37(8(K8WRE0vTC`Vq%LfYOt*a{?b9f&B+!7Az4t7i%`R6)*rr)oOtm?B z=j>4%nNElBXy-p@CnRb6H}EoyRH5P0{7_Eke7R58+v8`_^`NKlGz*pID$PS7sYK1r zsk`i&V-+ea5;n**3V-5MH)tULVv79yNIAcU!C8r4R?zR6yLib}0s9AQ>*walwCHKJG}_8f)C zwj1IO$znqDKTHkebjoN_$)&$m1M9L4wo9iPXE@R1r>GWSq5g>*&jAr^L5U&c_w25s zixS9$5Pts}4Qz180+)k$Q;oU*7TM+TI{TjN=gc_Tu{2^zxqa>7wus9ohe4bKuLH|h zj!!wAxNUJThqA`2H4Gt{!qc4KmeaQHdJXE1+?gMxE{c`-&%wP$ruJi12KMNFdu4{E!RKV*xa_Zl=R->f<$bL#6KXmpz5RBgN?P`#FERZvl0OYc;ooUy1b z_6N4;M*)U7QKqTG_KCTvi$+&Yg7L3B?6=vJrV+ctuY7T;O@_8vA58IQlm1_2kD7nX zy}4OEH9XvH9zf+D4FoHKon?T%5e}BIb~?3y#@N#SFy05ZCwD}WcxTXDnT=;vOxD&R z!>*1t%yXXWt@#q4OVkcv4;3V7BkCFU*2p62JR|0&Qv>V7vP@43HSxN1l5yGZHsCcm z9TVW`8#I9hZwKS4DUBr)-gT147D~GmRE=$gm#CJ!DB_ua`3FIoI1J$kU)=ugt0-c@ zL_=PPfpZ|*{i#eWmCWeonIqHO&w=Pl$W_) zJ2;9}o*Kz~2WnM?S;>4p*_*jS>2uR(>k28)`uO_@Oi5LvBu~J;e7ctWa>-m`CqFe< zZ3_k$_wtN_4Kh-HIkw6SHm?qy2Zowdy&MaCxxd%pGMvNVtbMj z|5Xfwj;+$9Ss|SU^B^^?Vb2z6K}Z!iHoZp#I#DQRswTEI>*SvNPC!F>zs#xGachP_ za^(u7T_R#P*4uXb$Y^YQd96NwP-fyX6i4c!KX&}MZJ6KR*4<@?jIBiFh@(u2Bo_4J zDMlz7{%-79`w!CAHfJ|jbYK}Bo&K3c3m@n#8efHm3(tfmp79N3Xs^vXsg`s)p7(#S z%sPZg^LyRXDoh6A`tj~Bf-#5f-=XPeLksiAisk+2d+$<-MdwYwN4=i0w%&_q3R9>Q z^scwEYm5=l)5T1KO%IL)qi~pMSjl7_kF@g`)XW3x2THV~%<3!o1BXn9r#7)(&!dx9 z*L(emX`eY{oon!@b+po($TabEXVN}F;|~^!;13hrAgEx>S7bEKj2#YZ=LCO^x2k!S z<^>wGXGEN@DhG{0_$e}4bt%rqQi)Gzmh}8pd@AhNu`B&}el>sAglF}?I=6GaK8Q#k zws*t4CmB*RoT}s2$#&En+3VWI9b^?PQH4~p&eP?dvFK$Xj zof^4IP5>EvQt zM~^8<>|3_b8r{OgWXO-JHrRSUJ>a`U)_7@KeUIXA-Mp(M6dAzzQ!EHmV=!HQBbO0__~?1^X_-b>+SMjq_bUG8T?h`t>aO$p z!sT%Fh9AoHCfl@P!)UlPYsMZgbV5srWpBRb-IV)qJA>}_>}RJx8#=k~q#bL;vOWP6 zOiO#GPA?WglsE;N?%(J0$k!=dk6BJ(rwU|49;gLDS8Le3hW7ccS6y8jCU5m*SX4u> zsPm+H>tN#q2PvnFZFj29`*ZYcC8|ub+=_*=l!1|i@mBLLef5}cc&-n|i(8GpM|EnP zYjfI>Ehy`>xGF?w_U1)~r`{(x5pZzHXmNnZzLW{#_)zlR#1V3Pc5j%V^FN8}H`==j zuU=p-)@;ndqE?pw`d*mQYL3-@Yup&*o=5~+8JS3{Dpf09rE6v&Hu{Z#>aucr4;RE*8NHBNTKHI`kZ16F1VLupD{BGpS<~ep9P*WGaPSY zLI9**gejhb4qF|j6eh+a?fMYLJj<|7uT6J#sP>?oRA>^;>t`q1`F1he=bgBdJ?82Y z#wn#Pta1rhH@n#myCFwnHtp63!n`|sr;wK~VbCV@b$#fidt0F}foTZA$X@&RB>JmE z6-g|5vdHJ#2bLlIY@>5?W%(#`)*qHH%?!l@y)q<{uK1UCv z81$-*b;RGe9VdOlPM6$BuuvgGmmM`X@T2xcphm@|`#7w^QgcBQU;Z)4B%C0q&Vim< z35jDW0({%MiVv7@GP&p8>g$Y}WbK;J1Ca{}XjgT0;AhD_9_!d|=sTAuXzLB9+8}6) z3=X4~K7wVP^)=LpN2A>wGT+7u3FqJ68lB!~Q_OGi4p+=a9Uic_yBDE>&90b@aXAs&;*Nb)H14{Qw3q&ox7 zm!itFU;IzjHYqR`9MUKX2|fO2#D4~j1@QrRxWPzF^q(vuL0~NOz#L-QJPCRKOrS43 z5RhWJGbqXbWIX`SP(l-!1BKTmr|TaI^bF}SMKGV#hd=Rv{PrHLll*U8w|4z#-*zR$-;nhO=>=# z*O)9D=^*hLL9IeJ9-V+=Fr)Q4PvpozvB}5|2x~>jcom;L`R#LVaC-oCRyV6w?AHdc z+e@}4@?)c-!eY3c{0K9aS0ot-mPq&&KZM;4a4qi6R`>5_Qi+?H;S@%EnZa&w-b>lM z{`C;TA9TQTd0rHK{_-V7FoUH+jDK3{e(MX^eIHtTBi?G-`__E)wb z5ixG(n}(aC4SaL;gW=8R(sG#y_=458N6c#4Nl{yT0| ztJNq^94(eL+X&Co=k*tWP`=*DLzE@Sad*1ch<>bzSchkjCGvSS$MLS1AR_(MGk3C0 zQVgg*5NY5t3Q;tT;6XO}l^EOBcfHrXY6u}ai`42RD^lh=_G4IUXq@mKuMMs2rXv4- z-}*M-iYxk33}nwT2JqgOcwTjC#gK`HG~h}Gcx*yTo3ZGk!lm(M=t$pQy)p-)MO`AfSj513`+amV%Z7U7Y(blO*OkJuKC3%n-P!H+fQrIC z-lDf?C{_ae^Rp1x-R5r}{9{r;&r(HE&`AZ%5HO{XuMNd&p{n~*Ot(4~)>JZMlwIvu zZ!N3{6%OlOcV+;VXFhw zTn?*2W0me@kDd|7cugOf^r!U?AjM3iNK&wB&Z<@DG*kV2BR7!UB~}iXuC%`3U^K$; zkYp%P?>n*G8mCO=HU1Db46Svr%xKA^j0a)v#b%TL){4Cl1X47sLqzyl8egp{^kwYEazUne$3w35{xh%<_Ijt0 z_`yWRLA7P+sLOWxXdoOtTA*7SOo;w)x+9*suS032xs0cA5^$ii$36Iyyf^Jm=}km! zfmgrHx0}NW1t3*oVVcTdG?E}=vE&>IsFqKwbqG>^)P*By(b2iR0|P2PS84kqy}Jul z-RnM)Hd^+KZ`Qm5e>$>5^V@=~>LbCRus~)5un=;pO z?H7{Yyw6+b_qCR$L~!Udf2k(&dvPc880Q!b$Mu&lIpohHA{s3Q3|UVta=XO!qMSLE z9@p9f@D>hn4|5lMFG_p~^k(*#*gB$UJYH}nR!*>)Db zjoSgKA(^Z5eSMj0W%UA$WP=QkQ~Hf0DI7)`fw1eZ8uhp*4Y)uS2FPiUN+p78N?S8_ zpvCk<_#9DylRK0dq0)?3B zS!Lk~@=5_)b)$CNaK^?srVk5)OvmFq5r~jo_jOO4jOB0*Z6>|l_cS?dEY#fi4rZH2 zHsTm-K}+jX(`usMo-W~up5X7qy=%1pAdnl5LK}w1p}TZ-XsFlB=G2sl9Ey`F)~