[SDSP-485] Support suppressions for secret rules

crates/bins/src/bin/datadog_static_analyzer_server/endpoints.rs

@@ -401,6 +401,7 @@ mod secret_scan_tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         };
         serde_json::value::RawValue::from_string(serde_json::to_string(&rule).unwrap()).unwrap()
     }

crates/bins/src/git_history.rs

@@ -466,6 +466,7 @@ mod git_history_tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         };
         let run_config = RunConfiguration {
             use_debug: false,

crates/cli/src/model/datadog_api.rs

@@ -5,7 +5,8 @@ use kernel::model::ruleset::RuleSet;
 use secrets::model::secret_rule::{
     SecretRule, SecretRuleMatchValidation, SecretRuleMatchValidationHttp,
     SecretRuleMatchValidationHttpCode, SecretRuleMatchValidationHttpMethod,
-    SecretRuleMatchValidationHttpV2, SecretRulePairedValidatorConfig, SecretRuleValidator,
+    SecretRuleMatchValidationHttpV2, SecretRulePairedValidatorConfig, SecretRuleSuppressions,
+    SecretRuleValidator,
 };
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
@@ -382,6 +383,7 @@ pub struct SecretRuleApiAttributes {
     pub paired_validator_config: Option<SecretRulePairedValidatorConfig>,
     pub pattern_capture_groups: Option<Vec<String>>,
     pub is_supporting_rule: Option<bool>,
+    pub suppressions: Option<SecretRuleSuppressions>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
@@ -426,6 +428,7 @@ impl TryFrom<SecretRuleApiType> for SecretRule {
             match_validation,
             pattern_capture_groups: val.attributes.pattern_capture_groups.unwrap_or_default(),
             is_supporting_rule: val.attributes.is_supporting_rule.unwrap_or(false),
+            suppressions: val.attributes.suppressions,
         })
     }
 }
@@ -580,6 +583,7 @@ mod tests {
                 paired_validator_config: None,
                 pattern_capture_groups: None,
                 is_supporting_rule: None,
+                suppressions: None,
             },
         };
         let converted = <SecretRuleApiType as TryInto<SecretRule>>::try_into(
@@ -618,6 +622,7 @@ mod tests {
                 paired_validator_config: None,
                 pattern_capture_groups: None,
                 is_supporting_rule: None,
+                suppressions: None,
             },
         };
         let converted = <SecretRuleApiType as TryInto<SecretRule>>::try_into(
@@ -655,6 +660,7 @@ mod tests {
                 paired_validator_config: None,
                 pattern_capture_groups: None,
                 is_supporting_rule: Some(true),
+                suppressions: None,
             },
         };
 
@@ -692,6 +698,7 @@ mod tests {
                 paired_validator_config: None,
                 pattern_capture_groups: None,
                 is_supporting_rule: None,
+                suppressions: None,
             },
         };
         let converted = <SecretRuleApiType as TryInto<SecretRule>>::try_into(
@@ -735,6 +742,7 @@ mod tests {
                 paired_validator_config: None,
                 pattern_capture_groups: None,
                 is_supporting_rule: None,
+                suppressions: None,
             },
         };
         let converted = <SecretRuleApiType as TryInto<SecretRule>>::try_into(
@@ -778,6 +786,7 @@ mod tests {
                 paired_validator_config: None,
                 pattern_capture_groups: None,
                 is_supporting_rule: None,
+                suppressions: None,
             },
         };
         let converted = <SecretRuleApiType as TryInto<SecretRule>>::try_into(
@@ -1091,4 +1100,41 @@ mod tests {
             }
         }
     }
+
+    #[test]
+    fn convert_secrets_rules_with_suppressions() {
+        let json_data = json!({
+            "data": [
+                {
+                    "id": "secrets/example-with-suppressions",
+                    "type": "secret_rule",
+                    "attributes": {
+                        "description": "test",
+                        "name": "Example Rule",
+                        "pattern": "\\bsecret\\b",
+                        "priority": "high",
+                        "sds_id": "some-sds-id",
+                        "suppressions": {
+                            "starts_with": ["test_"],
+                            "ends_with": ["_placeholder"],
+                            "exact_match": ["fake_secret"]
+                        }
+                    }
+                }
+            ]
+        });
+
+        let api_response: StaticAnalysisSecretsAPIResponse =
+            serde_json::from_value(json_data).expect("Failed to deserialize JSON");
+        let rule: SecretRule = api_response.data[0]
+            .clone()
+            .try_into()
+            .expect("Failed to convert rule");
+
+        assert_eq!(rule.id, "secrets/example-with-suppressions");
+        let suppressions = rule.suppressions.expect("expected suppressions");
+        assert_eq!(suppressions.starts_with, vec!["test_".to_string()]);
+        assert_eq!(suppressions.ends_with, vec!["_placeholder".to_string()]);
+        assert_eq!(suppressions.exact_match, vec!["fake_secret".to_string()]);
+    }
 }

crates/cli/src/sarif/sarif_utils.rs

@@ -1556,6 +1556,7 @@ mod tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         }
         .into();
         let secret_result: SarifRuleResult =
@@ -1726,6 +1727,7 @@ mod tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         }
         .into();
 
@@ -1836,6 +1838,7 @@ mod tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         }
         .into();
 
@@ -2098,6 +2101,7 @@ mod tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         };
 
         #[rustfmt::skip]
@@ -2242,6 +2246,7 @@ mod tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         };
 
         let secret_results = vec![SecretResult {
@@ -2335,6 +2340,7 @@ mod tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         };
 
         let secret_results = vec![SecretResult {
@@ -2438,6 +2444,7 @@ mod tests {
                 match_validation: None,
                 pattern_capture_groups: vec![],
                 is_supporting_rule: false,
+                suppressions: None,
             };
             let expected_level = get_level_from_severity(map_priority_to_severity(rule.priority));
 
@@ -2520,6 +2527,7 @@ mod tests {
                 match_validation: None,
                 pattern_capture_groups: vec![],
                 is_supporting_rule: false,
+                suppressions: None,
             };
             let secret_results = vec![SecretResult {
                 rule_id: rule.id.clone(),
@@ -2864,6 +2872,7 @@ mod tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         };
 
         let secret_results = vec![SecretResult {
@@ -3009,6 +3018,7 @@ mod tests {
             match_validation: None,
             pattern_capture_groups: vec![],
             is_supporting_rule: false,
+            suppressions: None,
         };
         let secrets_config = SecretsConfiguration {
             ignore_gitignore: true,

crates/secrets/src/model/secret_rule.rs

@@ -455,6 +455,26 @@ impl SecretRuleValidator {
     }
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, Eq, PartialEq, Default)]
+pub struct SecretRuleSuppressions {
+    #[serde(default)]
+    pub starts_with: Vec<String>,
+    #[serde(default)]
+    pub ends_with: Vec<String>,
+    #[serde(default)]
+    pub exact_match: Vec<String>,
+}
+
+impl From<SecretRuleSuppressions> for dd_sds::Suppressions {
+    fn from(v: SecretRuleSuppressions) -> Self {
+        dd_sds::Suppressions {
+            starts_with: v.starts_with,
+            ends_with: v.ends_with,
+            exact_match: v.exact_match,
+        }
+    }
+}
+
 // This is the secret rule exposed by SDS
 #[derive(Clone, Deserialize, Debug, Serialize, Eq, PartialEq)]
 pub struct SecretRule {
@@ -473,6 +493,8 @@ pub struct SecretRule {
     pub pattern_capture_groups: Vec<String>,
     #[serde(default)]
     pub is_supporting_rule: bool,
+    #[serde(default)]
+    pub suppressions: Option<SecretRuleSuppressions>,
 }
 
 impl SecretRule {
@@ -541,6 +563,10 @@ impl SecretRule {
             }
         }
 
+        if let Some(suppressions) = &self.suppressions {
+            rule_config = rule_config.suppressions(suppressions.clone().into());
+        }
+
         rule_config
     }
 }
@@ -632,6 +658,7 @@ mod tests {
             match_validation: None,
             pattern_capture_groups: vec!["sds_match".to_string()],
             is_supporting_rule: false,
+            suppressions: None,
         };
 
         // Validates that convert_to_sds_ruleconfig doesn't panic and returns a valid config.