[BigSpaceships]

What

New data

Why

otherwise it borked

Test Plan

dev and locally 10000 times

Env Vars

no

Documentation

no

Checklist

• [x ] Tested all changes locally

[datadog-computersciencehouse]

🔴 High: Code Vulnerability

Detected with AI

Potential SQL injection (...read more)

In PHP, SQL Injection (CWE-89) occurs when user-supplied input is concatenated or interpolated directly into a SQL query string without sanitization. PHP string interpolation ("SELECT * FROM users WHERE id = $id") and concatenation (".") do NOT sanitize — the taint is preserved into the SQL string.

To prevent SQL injection, use PDO or MySQLi prepared statements with bound parameters.

For example, instead of:

$id = $_GET['id'];
$result = $conn->query("SELECT * FROM users WHERE id = $id");

Use:

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$id]);

For query builders and ORMs (Doctrine, Eloquent, Laravel Query Builder), prefer their parameter-binding APIs over raw string interpolation.

_{Helpful? 👍/👎   
🚩 Report as false positive. Flags the rule for review to improve detection accuracy.}

[datadog-computersciencehouse]

🔴 High: Code Vulnerability

Detected with AI

Potential SQL injection (...read more)

In PHP, SQL Injection (CWE-89) occurs when user-supplied input is concatenated or interpolated directly into a SQL query string without sanitization. PHP string interpolation ("SELECT * FROM users WHERE id = $id") and concatenation (".") do NOT sanitize — the taint is preserved into the SQL string.

To prevent SQL injection, use PDO or MySQLi prepared statements with bound parameters.

For example, instead of:

$id = $_GET['id'];
$result = $conn->query("SELECT * FROM users WHERE id = $id");

Use:

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$id]);

For query builders and ORMs (Doctrine, Eloquent, Laravel Query Builder), prefer their parameter-binding APIs over raw string interpolation.

_{Helpful? 👍/👎   
🚩 Report as false positive. Flags the rule for review to improve detection accuracy.}

[datadog-computersciencehouse]

🟡 Low: Healthcheck instruction missing

Containers should expose an explicit `HEALTHCHECK` so runtimes and orchestrators can detect unhealthy applications and automatically restart or replace failing containers. Without a health check, internal failures may go... (...read more)

Containers should expose an explicit HEALTHCHECK so runtimes and orchestrators can detect unhealthy applications and automatically restart or replace failing containers. Without a health check, internal failures may go unnoticed and lead to reduced availability and slower incident recovery.

This rule verifies each Dockerfile build stage (each FROM) and requires a HEALTHCHECK instruction to be present in the stage's instruction set. Stages missing a HEALTHCHECK will be flagged.

Implement the HEALTHCHECK using the CMD form and sensible options (for example, --interval, --timeout, --start-period, --retries) so the probe is lightweight and accurately reflects service health.

Secure example:

FROM alpine:3.14
# application setup...

HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
  CMD wget -q -O /dev/null http://localhost:8080/health || exit 1

_{Helpful? 👍/👎     
🚩 Report as false positive. Flags the rule for review to improve detection accuracy.}

[datadog-computersciencehouse]

🟠 Medium: Avoid HTTP

Dockerfile `RUN` commands must not fetch resources over unencrypted HTTP, because clear-text downloads can be intercepted or modified in transit. This increases the risk of supply-chain compromise or execution of malicio... (...read more)

Dockerfile RUN commands must not fetch resources over unencrypted HTTP, because clear-text downloads can be intercepted or modified in transit. This increases the risk of supply-chain compromise or execution of malicious code in the built image.

This rule inspects dockerfile_container resources' RUN entries and flags tokens containing http:// (matches http: but not https:). URLs must use https:// instead of http://. Localhost addresses (http://localhost, http://127.0.0.1, http://[::1]) are excluded from detection.

When switching to HTTPS, also verify artifact integrity (for example, with checksums or signatures) or use trusted TLS-protected registries to further reduce tampering risk.

Secure example using HTTPS and checksum verification:

RUN curl -fsSL https://example.com/artifact.tar.gz -o /tmp/artifact.tar.gz && \
    echo "3b7d6f...  /tmp/artifact.tar.gz" | sha256sum -c -

_{Helpful? 👍/👎     
🚩 Report as false positive. Flags the rule for review to improve detection accuracy.}

[datadog-computersciencehouse]

🔴 High: Missing user instruction

Specify a non-root user in the Dockerfile so containers do not run as root by default, which reduces the blast radius of a compromise and prevents easy privilege escalation.

This check inspects every build stage (exclud... (...read more)

Specify a non-root user in the Dockerfile so containers do not run as root by default, which reduces the blast radius of a compromise and prevents easy privilege escalation.

This check inspects every build stage (excluding stages based on scratch) and flags the Dockerfile when no USER instruction appears in any stage. The Dockerfile must include a USER instruction that names a non-root user (username or numeric UID), preferably set in the final stage. Resources missing USER will be flagged.

This rule detects the absence of a USER instruction but does not validate the value—ensure the user is not root or UID 0 and that the user account is created in the image before switching to it.

Secure example:

FROM python:3.11-slim AS builder
# build steps...
FROM python:3.11-slim
RUN groupadd -r app && useradd -r -g app app
COPY --from=builder /app /app
USER app
CMD ["python", "/app/app.py"]

_{Helpful? 👍/👎     
🚩 Report as false positive. Flags the rule for review to improve detection accuracy.}

[datadog-computersciencehouse]

         

⚠️ Warnings

🛡️ 2 Code vulnerabilities detected

High: datadog/php-sqli

Detected with AI
Potential SQL injection
tools/Parser.php:122

High: datadog/php-sqli

Detected with AI
Potential SQL injection
tools/Parser.php:160

📚 20 Library vulnerabilities detected

Critical: minimist 0.0.10

Prototype Pollution in minimist

Critical: flatted 3.2.7

Prototype Pollution via parse() in NodeJS flatted

High: minimatch 3.0.8

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

View all

🧱 3 Infrastructure as Code (IaC) issues detected

High: Missing user instruction

Missing user instruction View rule
Dockerfile:14

Medium: Avoid HTTP

Avoid HTTP View rule
Dockerfile:17

Low: Healthcheck instruction missing

Healthcheck instruction missing View rule
Dockerfile:14

ℹ️ Info

No other issues found (see more)

🛠️ No new code quality issues
🔑 No new secrets detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: d080ef4 | Docs | Give us feedback!}

[aln730]

chom