Static Analysis

Relevant source files

The following files were used as context for generating this wiki page:

• content/en/security/code_security/static_analysis/_index.md
• content/en/security/code_security/static_analysis/setup/_index.md
• content/en/security/code_security/static_analysis/static_analysis_rules/_index.md
• content/en/getting_started/code_security/_index.md
• content/en/security/code_security/troubleshooting/_index.md
• content/en/developers/ide_plugins/idea/code_security.md
• content/en/security/code_security/static_analysis/custom_rules/_index.md
• content/fr/code_analysis/static_analysis/_index.md

Datadog Static Analysis is a Static Application Security Testing (SAST) capability that analyzes a program's pre-production source code for security vulnerabilities and maintainability issues without executing it. It helps identify problems early in the software development life cycle (SDLC), ensuring that only high-quality, secure code reaches production. By integrating into various stages of development, from the IDE to CI/CD pipelines, it helps make applications less vulnerable, standardizes code quality, and accelerates developer onboarding by maintaining a readable codebase.

Static Analysis is a core component of the broader Datadog Code Security platform, which also includes Software Composition Analysis (SCA) and Interactive Application Security Testing (IAST).

Sources: content/en/security/code_security/static_analysis/_index.md:14-26, content/en/getting_started/code_security/_index.md:9-14

Core Concepts

Supported Languages

Static Analysis supports scanning for security vulnerabilities and poor coding practices across a variety of languages and technologies.

Language / Technology
Apex
C#
Docker
GitHub Actions
Go
Java
JavaScript / JSX
Kotlin
PHP
Python
Ruby
Swift
TypeScript / TSX

Sources: content/en/security/code_security/static_analysis/setup/_index.md:83-118

Violations and Rulesets

After a scan, identified issues are categorized as either Code Vulnerabilities or Code Quality issues.

Category	Description
Code Vulnerabilities	Contains violations found by rules in the Security category.
Code Quality	Contains violations from Best Practices, Code Style, Error Prone, or Performance categories.

These categories are determined by the ruleset that flags the violation. Datadog provides numerous out-of-the-box rulesets for each supported language, such as python-security, java-best-practices, and javascript-code-style.

Sources: content/en/security/code_security/static_analysis/_index.md:46-51, content/en/security/code_security/static_analysis/static_analysis_rules/_index.md:1-210

Setup and Configuration

Static Analysis scans can be executed either directly on Datadog's infrastructure (hosted scanning) or within your own CI/CD pipelines.

The diagram below shows the initial setup decision flow.

Configuration Hierarchy

Static Analysis can be configured at multiple levels. These configurations are merged using an overlay/patch method, where more specific levels take precedence.

The diagram below illustrates the configuration merge order.

This hierarchical approach allows for global standards to be set at the organization level, with overrides available for specific repositories or even local testing via a repository file. For example, a rule's ignore path defined in the repository file will overwrite an ignore path for the same rule defined at the org level.

Sources: content/en/security/code_security/static_analysis/setup/_index.md:128-181

Configuration File (static-analysis.datadog.yml)

Customizations are managed via a YAML file, which can be applied in the Datadog UI or placed at the root of a repository as static-analysis.datadog.yml.

Top-Level Configuration

Property	Type	Description
rulesets	Array	A list of rulesets to analyze. This is a required field.
only	Array	A list of file paths or glob patterns. If provided, only matching files are analyzed across all rulesets.
ignore	Array	A list of file paths or glob patterns to exclude from analysis across all rulesets.

Sources: content/en/security/code_security/static_analysis/setup/_index.md:214-221

Ruleset and Rule Configuration

Within the rulesets array, you can specify configurations for individual rulesets and the rules within them.

Scope	Property	Description
Ruleset	only	File paths or glob patterns to which this ruleset will be applied.
Ruleset	ignore	File paths or glob patterns to exclude from this ruleset's analysis.
Ruleset	rules	An object mapping individual rule names to their specific configurations.
Rule	only	File paths or glob patterns where this specific rule will be applied.
Rule	ignore	File paths or glob patterns to exclude from this rule's application.
Rule	arguments	Parameters and values for rules that support them. Values can be static or path-specific.
Rule	severity	Override the rule's default severity (ERROR, WARNING, NOTICE, NONE). Can be static or path-specific.
Rule	category	Override the rule's category (BEST_PRACTICES, CODE_STYLE, ERROR_PRONE, PERFORMANCE, SECURITY).

Sources: content/en/security/code_security/static_analysis/setup/_index.md:227-279

Example Configuration

The following snippet shows how to customize rulesets and rules, set arguments, and define file paths.

rulesets:
  - python-best-practices
  - python-security
  - python-code-style:
    rules:
      max-function-lines:
        # Do not apply the rule max-function-lines to the following files
        ignore:
          - "src/main/util/process.py"
        arguments:
          # Set the max-function-lines rule's threshold to 150 lines
          max-lines: 150
        # Override this rule's severity
        severity: NOTICE
      max-class-lines:
        arguments:
          # Set different thresholds for the max-class-lines rule in different subtrees
          max-lines:
            # Set the rule's threshold to 200 lines by default (root path of the repo)
            /: 200
            # Set the rule's threshold to 100 lines in src/main/backend
            src/main/backend: 100
# Only analyze source files
only:
  - "src/main"
# Do not analyze third-party or generated files
ignore:
  - "lib/third_party"

Sources: content/en/security/code_security/static_analysis/setup/_index.md:285-325

Integration into the Development Lifecycle

Static Analysis integrates at multiple points in the SDLC to provide continuous feedback.

This diagram shows the various integration points for Static Analysis.

• IDEs: The Datadog plugin for JetBrains and VS Code allows developers to run local scans and see violations directly in the editor before committing code.
• Source Code Management: Datadog can automatically add inline comments to pull requests in GitHub, GitLab, and Azure DevOps, flagging violations on the relevant lines of code.
• CI/CD Pipelines: The datadog-ci CLI tool runs scans within CI pipelines, which can be configured to block builds or deployments based on scan results.

Sources: content/en/security/code_security/static_analysis/_index.md:32-43, content/en/developers/ide_plugins/idea/code_security.md:18-24

Violation Analysis and Remediation

Exploring and Fixing Violations

When a violation is detected, it appears in the Code Security section of the Datadog UI. From there, you can analyze and remediate it.

This flowchart outlines the remediation process.

Suggested Fixes

Datadog provides two types of suggested fixes to accelerate remediation:

1. Deterministic Suggested Fix: For simple issues like linting problems, the analyzer provides a templated, guaranteed fix.
2. AI-Suggested Fix: For more complex violations, OpenAI's GPT-4 is used to generate a suggested fix. This can be provided as plain text instructions or a unified diff.

Sources: content/en/security/code_security/static_analysis/_index.md:85-95, content/fr/code_analysis/static_analysis/_index.md:104-114

Ignoring Violations

Violations can be ignored at different scopes:

• For a specific instance: Add a // no-dd-sa or # no-dd-sa comment above the line of code. To ignore a specific rule, use no-dd-sa:<rule-name>.
• For a file or directory: Add an ignore path under the specific rule in the static-analysis.datadog.yml file.
• For an entire repository: Add ignore: ["**"] under the rule in the static-analysis.datadog.yml file.

Sources: content/en/security/code_security/static_analysis/setup/_index.md:330-366

Custom Rules

Datadog allows the creation of custom static analysis rules to enforce organization-specific coding standards or security checks. Custom rules are organized into rulesets.

A custom rule consists of three main components:

1. Tree-sitter Query: Uses tree-sitter to query the code's Abstract Syntax Tree (AST) and capture relevant nodes.
2. JavaScript Code: A visit(node, path, code) function that processes the captured AST nodes and reports violations using addError().
3. Test Code: To validate the rule's logic.

Sources: content/en/security/code_security/static_analysis/custom_rules/_index.md:17-31

Linking Findings to Services and Teams

Datadog automatically associates static analysis findings with the relevant services and teams to streamline ownership and triage.

The association is made using the following mechanisms in order of precedence:

1. Software Catalog (entity.datadog.yaml): The codeLocations field in a service's v3 schema definition explicitly maps a service to a repository and specific paths.
2. File Usage Patterns: Datadog products like Error Tracking can link a file path from a stack trace to a runtime service.
3. Name Matching: Datadog searches for the service name in the repository name or file path.
4. CODEOWNERS File: If no service is matched, Datadog uses the repository's CODEOWNERS file to associate the finding with a team. This requires mapping Git provider teams to Datadog teams.

Sources: content/en/getting_started/code_security/_index.md:166-220, content/en/security/code_security/static_analysis/setup/_index.md:369

Conclusion

Datadog Static Analysis is a powerful SAST tool that integrates deeply into the software development lifecycle. By providing early feedback in IDEs, automated checks in pull requests, and robust CI/CD pipeline integration, it empowers developers to write more secure and maintainable code. Its flexible configuration, detailed violation analysis, and automated remediation suggestions help organizations enforce coding standards and improve their overall security posture efficiently.