feat: add datadog(hot-shots) rule

integration/rules/javascript_test.go

@@ -121,3 +121,13 @@ func TestJavascriptAlgoliaSummary(t *testing.T) {
 	t.Parallel()
 	runRulesTest("javascript/third_parties/algolia", "summary", "javascript_third_parties_algolia", t)
 }
+
+func TestJavascriptDataDogDataflow(t *testing.T) {
+	t.Parallel()
+	runRulesTest("javascript/third_parties/datadog", "dataflow", "javascript_third_parties_datadog", t)
+}
+
+func TestJavascriptDataDogSummary(t *testing.T) {
+	t.Parallel()
+	runRulesTest("javascript/third_parties/datadog", "summary", "javascript_third_parties_datadog", t)
+}

new/detector/implementation/javascript/object/object.go

@@ -20,7 +20,8 @@ type objectDetector struct {
 	variableDeclarationQuery *tree.Query
 	parentPairQuery          *tree.Query
 	// class
-	classNameQuery *tree.Query
+	classNameQuery   *tree.Query
+	constructorQuery *tree.Query
 	// properties
 	memberExpressionQuery    *tree.Query
 	subscriptExpressionQuery *tree.Query
@@ -60,6 +61,12 @@ func New(lang languagetypes.Language) (types.Detector, error) {
 		return nil, fmt.Errorf("error compiling class name query: %s", err)
 	}
 
+	// new User()
+	constructorQuery, err := lang.CompileQuery(`(new_expression constructor: (identifier) @name) @root`)
+	if err != nil {
+		return nil, fmt.Errorf("error compiling class name query: %s", err)
+	}
+
 	// user.name
 	memberExpressionQuery, err := lang.CompileQuery(`(member_expression object: (_) @object property: (property_identifier) @property) @root`)
 	if err != nil {
@@ -78,6 +85,7 @@ func New(lang languagetypes.Language) (types.Detector, error) {
 		variableDeclarationQuery: variableDeclarationQuery,
 		parentPairQuery:          parentPairQuery,
 		classNameQuery:           classNameQuery,
+		constructorQuery:         constructorQuery,
 		memberExpressionQuery:    memberExpressionQuery,
 		subscriptExpressionQuery: subscriptExpressionQuery,
 	}, nil
@@ -115,6 +123,11 @@ func (detector *objectDetector) DetectAt(
 		return detections, err
 	}
 
+	detections, err = detector.getConstructor(node, evaluator)
+	if len(detections) != 0 || err != nil {
+		return detections, err
+	}
+
 	detections, err = detector.getProperties(node, evaluator)
 	if len(detections) != 0 || err != nil {
 		return detections, err
@@ -232,6 +245,19 @@ func (detector *objectDetector) getClass(node *tree.Node, evaluator types.Evalua
 	return []interface{}{data}, nil
 }
 
+func (detector *objectDetector) getConstructor(node *tree.Node, evaluator types.Evaluator) ([]interface{}, error) {
+	result, err := detector.constructorQuery.MatchOnceAt(node)
+	if result == nil || err != nil {
+		return nil, err
+	}
+
+	data := generictypes.Object{
+		Name: result["name"].Content(),
+	}
+
+	return []interface{}{data}, nil
+}
+
 func (detector *objectDetector) nameParentPairObject(
 	node *tree.Node,
 	evaluator types.Evaluator,

new/language/implementation/javascript/javascript.go

@@ -98,6 +98,7 @@ func (*javascriptImplementation) AnalyzeFlow(rootNode *tree.Node) error {
 
 			if slice.Contains(variableLookupParents, parent.Type()) ||
 				(parent.Type() == "assignment_expression" && node.Equal(parent.ChildByFieldName("right"))) ||
+				(parent.Type() == "new_expression" && node.Equal(parent.ChildByFieldName("constructor"))) ||
 				(parent.Type() == "variable_declarator" && node.Equal(parent.ChildByFieldName("value"))) ||
 				(parent.Type() == "member_expression" && node.Equal(parent.ChildByFieldName("object"))) ||
 				(parent.Type() == "call_expression" && node.Equal(parent.ChildByFieldName("function"))) ||

pkg/commands/process/settings/rules/javascript/third_parties/datadog.yml

@@ -0,0 +1,45 @@
+patterns:
+  - pattern: |
+      $<CLIENT>.$<METHOD>($<...>$<DATA_TYPE>$<...>)
+    filters:
+      - variable: CLIENT
+        detection: javascript_third_parties_hotshot_statsd
+      - variable: DATA_TYPE
+        detection: datatype
+      - variable: METHOD
+        values:
+          - event
+          - increment
+          - historgram
+          - set
+languages:
+  - javascript
+auxiliary:
+  - id: javascript_third_parties_hotshot_statsd
+    patterns:
+      - |
+        new StatsD($<...>)
+trigger: local
+severity:
+  default: low
+  PII: critical
+  PHI: medium
+  PD: high
+skip_data_types:
+  - "Unique Identifier"
+metadata:
+  description: "Do not send sensitive data to Datadog."
+  remediation_message: |
+    ## Description
+    Leaking sensitive data to third-party loggers is a common cause of data leaks and can lead to data breaches. This rule looks for instances of sensitive data sent to Datadog.
+
+    ## Remediations
+
+    When logging errors or events, ensure all sensitive data is removed.
+
+    ## Resources
+    - [Datadog docs](https://docs.datadoghq.com)
+    - [Scrubbing data](https://docs.datadoghq.com/tracing/configure_data_security/?tab=mongodb#scrub-sensitive-data-from-your-spans)
+  dsr_id: DSR-1
+  associated_recipe: Datadog
+  id: javascript_third_parties_datadog

pkg/commands/process/settings/rules/javascript/third_parties/datadog/.snapshots/TestJavascriptDataDogDataflow-dataflow_javascript_third_parties_datadog_secure.js

@@ -0,0 +1,20 @@
+risks:
+    - detector_id: javascript_third_parties_hotshot_statsd
+      locations:
+        - filename: pkg/commands/process/settings/rules/javascript/third_parties/datadog/testdata/secure.js
+          line_number: 2
+          parent:
+            line_number: 2
+            content: |-
+                new StatsD({
+                	port: 8020,
+                	globalTags: { env: process.env.NODE_ENV },
+                	errorHandler: errorHandler,
+                })
+          content: |
+            new StatsD($<...>)
+components: []
+
+
+--
+

pkg/commands/process/settings/rules/javascript/third_parties/datadog/.snapshots/TestJavascriptDataDogDataflow-dataflow_javascript_third_parties_datadog_unsecure.js

@@ -0,0 +1,63 @@
+data_types:
+    - name: Email Address
+      detectors:
+        - name: javascript
+          locations:
+            - filename: pkg/commands/process/settings/rules/javascript/third_parties/datadog/testdata/unsecure.js
+              line_number: 3
+              field_name: email
+              object_name: user
+              subject_name: User
+    - name: Fullname
+      detectors:
+        - name: javascript
+          locations:
+            - filename: pkg/commands/process/settings/rules/javascript/third_parties/datadog/testdata/unsecure.js
+              line_number: 3
+              field_name: name
+              object_name: user
+              subject_name: User
+risks:
+    - detector_id: javascript_third_parties_datadog
+      data_types:
+        - name: Email Address
+          stored: false
+          locations:
+            - filename: pkg/commands/process/settings/rules/javascript/third_parties/datadog/testdata/unsecure.js
+              line_number: 3
+              parent:
+                line_number: 11
+                content: client.event("user", "logged_in", {}, user)
+              field_name: email
+              object_name: user
+              subject_name: User
+        - name: Fullname
+          stored: false
+          locations:
+            - filename: pkg/commands/process/settings/rules/javascript/third_parties/datadog/testdata/unsecure.js
+              line_number: 3
+              parent:
+                line_number: 11
+                content: client.event("user", "logged_in", {}, user)
+              field_name: name
+              object_name: user
+              subject_name: User
+    - detector_id: javascript_third_parties_hotshot_statsd
+      locations:
+        - filename: pkg/commands/process/settings/rules/javascript/third_parties/datadog/testdata/unsecure.js
+          line_number: 5
+          parent:
+            line_number: 5
+            content: |-
+                new StatsD({
+                	port: 8020,
+                	globalTags: { env: process.env.NODE_ENV },
+                	errorHandler: errorHandler,
+                })
+          content: |
+            new StatsD($<...>)
+components: []
+
+
+--
+

pkg/commands/process/settings/rules/javascript/third_parties/datadog/.snapshots/TestJavascriptDataDogSummary-summary_javascript_third_parties_datadog_secure.js

@@ -0,0 +1,5 @@
+{}
+
+
+--
+

pkg/commands/process/settings/rules/javascript/third_parties/datadog/.snapshots/TestJavascriptDataDogSummary-summary_javascript_third_parties_datadog_unsecure.js

@@ -0,0 +1,15 @@
+critical:
+    - rule_dsrid: DSR-1
+      rule_display_id: javascript_third_parties_datadog
+      rule_description: Do not send sensitive data to Datadog.
+      rule_documentation_url: https://curio.sh/reference/rules/javascript_third_parties_datadog
+      line_number: 3
+      filename: pkg/commands/process/settings/rules/javascript/third_parties/datadog/testdata/unsecure.js
+      category_groups:
+        - PII
+      parent_line_number: 11
+      parent_content: client.event("user", "logged_in", {}, user)
+
+
+--
+

pkg/commands/process/settings/rules/javascript/third_parties/datadog/testdata/secure.js

@@ -0,0 +1,8 @@
+const StatsD = require("hot-shots");
+const client = new StatsD({
+	port: 8020,
+	globalTags: { env: process.env.NODE_ENV },
+	errorHandler: errorHandler,
+});
+
+client.event("user", "logged_in", {});

pkg/commands/process/settings/rules/javascript/third_parties/datadog/testdata/unsecure.js

@@ -0,0 +1,11 @@
+const StatsD = require("hot-shots");
+
+const user = { name: "jhon", email: "jhon@gmail.com" };
+
+const client = new StatsD({
+	port: 8020,
+	globalTags: { env: process.env.NODE_ENV },
+	errorHandler: errorHandler,
+});
+
+client.event("user", "logged_in", {}, user);