Don’t underestimate grep-based code scanning
littlemaninmyhead.wordpress.com
Don’t underestimate grep-based code scanning
1–10 of 122 posts
Re: Don’t underestimate grep-based code scanning
#2Just a small note that I would highgly recommend ripgrep[0] over standard grep. It's another modern tool that has been created by leveraging Rust and it's from BurntSushi[1] who is excellent.
Re: Don’t underestimate grep-based code scanning
#3One thing which was not immediately obvious to me for a while: the stricter your language’s formatting is, the easier it will be to grep source code.
I work a lot with Go, where all code in our repository is gofmt'ed. You can get quite far with regular expressions for finding/analyzing Go code.
(And when regexps don’t cut it anymore, Go has excellent infrastructure for working with it programmatically. http://golang.org/s/types-tutorial is a great introduction!)
Re: Don’t underestimate grep-based code scanning
#4Just a small note that I would highgly recommend ripgrep[0] over standard grep. It's another modern tool that has been created by leveraging Rust and it's from BurntSushi[1] who is excellent. 0: https://github.com/BurntSushi/ripgrep 1. https://github.com/BurntSushi
In general I think that's very good advice. In this particular instance however a dumb old grep might be superior because it could catch potential security vulnerabilities that are not explicitly hardcoded in the source code by greping through the compilation artifacts for instance. Sure you'll get a bunch of false positives that way but at least you know that nothing is slipping through the cracks.
Re: Don’t underestimate grep-based code scanning
#5Just a small note that I would highgly recommend ripgrep[0] over standard grep. It's another modern tool that has been created by leveraging Rust and it's from BurntSushi[1] who is excellent. 0: https://github.com/BurntSushi/ripgrep 1. https://github.com/BurntSushi
Why is it better than grep?
Re: Don’t underestimate grep-based code scanning
#6Just a small note that I would highgly recommend ripgrep[0] over standard grep. It's another modern tool that has been created by leveraging Rust and it's from BurntSushi[1] who is excellent. 0: https://github.com/BurntSushi/ripgrep 1. https://github.com/BurntSushi
Why is it better than grep?
It's way faster, which is great when you're working with big repos. It's designed for recursively searching through a lot of files.
Re: Don’t underestimate grep-based code scanning
#7Just a small note that I would highgly recommend ripgrep[0] over standard grep. It's another modern tool that has been created by leveraging Rust and it's from BurntSushi[1] who is excellent. 0: https://github.com/BurntSushi/ripgrep 1. https://github.com/BurntSushi
Why is it better than grep?
Like a few other tools — ack, ag, and pt — it's specialized for source code, in addition to that it's really fast. The repo contains detailed comparisons with grep and an FAQ.
Re: Don’t underestimate grep-based code scanning
#8Earlier quoted context omitted.
Why is it better than grep?
It's way faster, which is great when you're working with big repos. It's designed for recursively searching through a lot of files.
Grep is really fast at that at the actual search (gnu grep at least), the gain there is mostly that "smarter" tools will ignore e.g. VCS data or binary files by default whereas grep will trawl through your PNGs and git packfiles.
Re: Don’t underestimate grep-based code scanning
#9Just a small note that I would highgly recommend ripgrep[0] over standard grep. It's another modern tool that has been created by leveraging Rust and it's from BurntSushi[1] who is excellent. 0: https://github.com/BurntSushi/ripgrep 1. https://github.com/BurntSushi
Why is it better than grep?
Blog post from the author with pros & cons of rg
https://blog.burntsushi.net/ripgrep/
(It seems down at the moment you can try the cached version)
Re: Don’t underestimate grep-based code scanning
#10Earlier quoted context omitted.
It's way faster, which is great when you're working with big repos. It's designed for recursively searching through a lot of files.
Grep is really fast at that at the actual search (gnu grep at least), the gain there is mostly that "smarter" tools will ignore e.g. VCS data or binary files by default whereas grep will trawl through your PNGs and git packfiles.
Explanation from the original author on why GNU grep is fast: https://lists.freebsd.org/pipermail/freebsd-current/2010-Aug...
Excerpt: "The result of this is that, in the limit, GNU grep averages fewer than 3 x86 instructions executed for each input byte it actually looks at (and it skips many bytes entirely)."