[SDS-1788] support additional SDS Secondary Validators by isabella-garza-datadog · Pull Request #788 · DataDog/datadog-static-analyzer

isabella-garza-datadog · 2025-10-30T20:30:11Z

What problem are you trying to solve?

Currently in convert_to_sds_ruleconfig, the only validator that is getting applied from the SDS configurations is JwtExpirationChecker. However, the current version of the sds library supports more validators for Secrets (i.e GithubTokenChecksum).

What is your solution?

This PR updates the convert_to_sds_ruleconfig function to configure all validators that are supported in the sds library version.

Alternatives considered

What the reviewer should know

Validation

Validated that before the change a Github Access Token with an invalid checksum gets matched

Configuration
=============
version                 : 0.7.0
revision                : development
config method           : remote configuration
cores available         : 16
cores used              : 8
#static analysis rules  : 0
#secrets rules loaded   : 51
source directory        : /Users/isabella.garza/go/src/github.com/DataDog/datadog-static-analyzer
subdirectories          : 
output file             : result.json
static analysis enabled:  false
secrets enabled         : true
output format           : sarif
ignore paths            : debug/,target/,**/*.rs.bk,*.pdb,*~,crates/static-analysis-kernel/.vendor/,.idea,venv,**/node_modules/**/*,**/jspm_packages/**/*,**/.next/**/*,**/.vuepress/**/*,**/venv/**/*,**/__pycache__/**/*,**/_vendor/bundle/ruby/**/*,**/.vendor/bundle/ruby/**/*,**/.bundle/**/*,**/.gradle/**/*,**/TemporaryGeneratedFile_.*.cs,**/*.designer.cs,**/*.generated.cs,**/*.g.cs,**/*.g.i.cs
only paths              : all paths
ignore gitignore        : false
use debug               : true
use staging             : false
ignore gen files        : true
rules languages         : 
max file size           : 200 kb
diff aware data: None
File /Users/isabella.garza/go/src/github.com/DataDog/datadog-static-analyzer/misc/imgs/jetbrains.gif too big (size 263449 bytes, max size 200 kb (204800 bytes))
File /Users/isabella.garza/go/src/github.com/DataDog/datadog-static-analyzer/misc/imgs/vscode.gif too big (size 347839 bytes, max size 200 kb (204800 bytes))
Found 19 secret(s) (including 0 valid) in 4 file(s) using 10 rule(s) within 1 sec(s)

Validated that after the change a Github Access Token with an invalid checksum does not get matched

Configuration
=============
version                 : 0.7.0
revision                : development
config method           : remote configuration
cores available         : 16
cores used              : 8
#static analysis rules  : 0
#secrets rules loaded   : 51
source directory        : /Users/isabella.garza/go/src/github.com/DataDog/datadog-static-analyzer
subdirectories          : 
output file             : result.json
static analysis enabled:  false
secrets enabled         : true
output format           : sarif
ignore paths            : debug/,target/,**/*.rs.bk,*.pdb,*~,crates/static-analysis-kernel/.vendor/,.idea,venv,**/node_modules/**/*,**/jspm_packages/**/*,**/.next/**/*,**/.vuepress/**/*,**/venv/**/*,**/__pycache__/**/*,**/_vendor/bundle/ruby/**/*,**/.vendor/bundle/ruby/**/*,**/.bundle/**/*,**/.gradle/**/*,**/TemporaryGeneratedFile_.*.cs,**/*.designer.cs,**/*.generated.cs,**/*.g.cs,**/*.g.i.cs
only paths              : all paths
ignore gitignore        : false
use debug               : true
use staging             : false
ignore gen files        : true
rules languages         : 
max file size           : 200 kb
diff aware data: None
File /Users/isabella.garza/go/src/github.com/DataDog/datadog-static-analyzer/misc/imgs/jetbrains.gif too big (size 263449 bytes, max size 200 kb (204800 bytes))
File /Users/isabella.garza/go/src/github.com/DataDog/datadog-static-analyzer/misc/imgs/vscode.gif too big (size 347839 bytes, max size 200 kb (204800 bytes))
Found 18 secret(s) (including 0 valid) in 3 file(s) using 9 rule(s) within 1 sec(s)

jamesphlewis

tentative approval, let's test from staging (with the new API response) and production (with the old API response) first before merging to ensure we don't break backwards compat.

…alidators

isabella-garza-datadog · 2025-11-11T18:14:00Z

Testing Summary

To verify the new V2 version of the Secret Rule Validator API field (https://github.com/DataDog/dd-source/pull/304183) and ensure backward compatibility with the datadog-static-analyzer service, I performed the following tests after deploying the API changes to staging. I was scanning the datadog-static-analyzer repository during these tests.

Staging API + datadog-static-analyzer (main) → Detected 3 secrets (expected)
Staging API + datadog-static-analyzer (feature branch) → Detected 2 secrets (expected)
Prod API + datadog-static-analyzer (main) → Detected 3 secrets (expected)
Prod API + datadog-static-analyzer (feature branch) → Detected 2 secrets (expected)

In these tests, I added a new test secret that matches with the main branch of datadog-static-analyzer but not with the feature branch due to an invalid checksum. The observed results confirm that the changes are working as expected and maintain backward compatibility.

isabella-garza-datadog · 2025-11-11T18:31:18Z

/merge

dd-devflow-routing-codex · 2025-11-11T18:31:22Z

View all feedbacks in Devflow UI.

2025-11-11 18:31:22 UTC ℹ️ Start processing command /merge

2025-11-11 18:31:27 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 19m (p90).

2025-11-11 18:52:56 UTC ❌ MergeQueue: The checks failed on this merge request

Tests failed on this commit 616ea2c:

What to do next?

Investigate the failures and when ready, re-add your pull request to the queue!
If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
Any question, go check the FAQ.

…alidators

isabella-garza-datadog · 2025-11-11T21:58:01Z

/merge

dd-devflow-routing-codex · 2025-11-11T21:58:05Z

View all feedbacks in Devflow UI.

2025-11-11 21:58:05 UTC ℹ️ Start processing command /merge

2025-11-11 21:58:08 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 33m (p90).

2025-11-11 22:16:34 UTC ❌ MergeQueue: The checks failed on this merge request

Tests failed on this commit fca2709:

check_regressions (muh-nee, DSVW)

What to do next?

Investigate the failures and when ready, re-add your pull request to the queue!
If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
Any question, go check the FAQ.

isabella-garza-datadog · 2025-11-12T13:54:26Z

/merge

dd-devflow-routing-codex · 2025-11-12T13:54:30Z

View all feedbacks in Devflow UI.

2025-11-12 13:54:30 UTC ℹ️ Start processing command /merge

2025-11-12 13:54:34 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 33m (p90).

2025-11-12 14:14:11 UTC ❌ MergeQueue: The checks failed on this merge request

Tests failed on this commit b57c996:

check_regressions (numpy, numpy)

What to do next?

Investigate the failures and when ready, re-add your pull request to the queue!
If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
Any question, go check the FAQ.

isabella-garza-datadog · 2025-11-12T16:16:15Z

/merge

dd-devflow-routing-codex · 2025-11-12T16:16:18Z

View all feedbacks in Devflow UI.

2025-11-12 16:16:18 UTC ℹ️ Start processing command /merge

2025-11-12 16:16:23 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 33m (p90).

2025-11-12 16:33:58 UTC ℹ️ MergeQueue: This merge request was merged

isabella-garza-datadog added 3 commits October 30, 2025 15:18

[SDS] support additional Secondary Validators

ad1efe9

[SDS] only load allowed validators once

9c54f90

[SDS] only print error in debug mode

a833986

isabella-garza-datadog marked this pull request as ready for review November 4, 2025 21:02

isabella-garza-datadog requested a review from a team as a code owner November 4, 2025 21:02

jamesphlewis approved these changes Nov 7, 2025

View reviewed changes

Merge branch 'main' into isabella.garza/SDS-1788-support-string-SDS-v…

6afebb2

…alidators

dd-devflow bot added mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: rejected and removed mergequeue-status: queued mergequeue-status: in_progress labels Nov 11, 2025

Merge branch 'main' into isabella.garza/SDS-1788-support-string-SDS-v…

6c6da89

…alidators

dd-devflow bot added mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: rejected and removed mergequeue-status: rejected mergequeue-status: queued mergequeue-status: in_progress labels Nov 11, 2025

dd-devflow bot added mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: rejected mergequeue-status: queued labels Nov 12, 2025

dd-devflow bot added mergequeue-status: rejected and removed mergequeue-status: in_progress labels Nov 12, 2025

dd-devflow bot added mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: rejected mergequeue-status: queued labels Nov 12, 2025

dd-mergequeue bot merged commit f6e27ad into main Nov 12, 2025
124 of 134 checks passed

dd-devflow bot removed the mergequeue-status: in_progress label Nov 12, 2025

dd-mergequeue bot deleted the isabella.garza/SDS-1788-support-string-SDS-validators branch November 12, 2025 16:33

dd-devflow bot added the mergequeue-status: done label Nov 12, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SDS-1788] support additional SDS Secondary Validators#788

[SDS-1788] support additional SDS Secondary Validators#788
dd-mergequeue[bot] merged 5 commits intomainfrom
isabella.garza/SDS-1788-support-string-SDS-validators

isabella-garza-datadog commented Oct 30, 2025

Uh oh!

jamesphlewis left a comment

Uh oh!

isabella-garza-datadog commented Nov 11, 2025

Uh oh!

isabella-garza-datadog commented Nov 11, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 11, 2025 •

edited

Loading

Uh oh!

isabella-garza-datadog commented Nov 11, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 11, 2025 •

edited

Loading

Uh oh!

isabella-garza-datadog commented Nov 12, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 12, 2025 •

edited

Loading

Uh oh!

isabella-garza-datadog commented Nov 12, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 12, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

isabella-garza-datadog commented Oct 30, 2025

What problem are you trying to solve?

What is your solution?

Alternatives considered

What the reviewer should know

Validation

Uh oh!

jamesphlewis left a comment

Choose a reason for hiding this comment

Uh oh!

isabella-garza-datadog commented Nov 11, 2025

Testing Summary

Uh oh!

isabella-garza-datadog commented Nov 11, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What to do next?

Uh oh!

isabella-garza-datadog commented Nov 11, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What to do next?

Uh oh!

isabella-garza-datadog commented Nov 12, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What to do next?

Uh oh!

isabella-garza-datadog commented Nov 12, 2025

Uh oh!

dd-devflow-routing-codex bot commented Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dd-devflow-routing-codex bot commented Nov 11, 2025 •

edited

Loading

dd-devflow-routing-codex bot commented Nov 11, 2025 •

edited

Loading

dd-devflow-routing-codex bot commented Nov 12, 2025 •

edited

Loading

dd-devflow-routing-codex bot commented Nov 12, 2025 •

edited

Loading