Semgrep's pretty slick. I tried out a demo and I was pretty blown away by how I could essentially just guess my way to a signature.
Semgrep: Lightweight static analysis for many languages
11–20 of 29 posts
Re: Semgrep: Lightweight static analysis for many languages
#12Just went through the examples. Seems really intuitive and looks like it would be a good approach for homegrown linters. Would also love to see some plugin support for editors.
Agreed. What editors do you have in mind?
I filed a ticket for VS Code support because I’ve seen it mentioned in a few of the other comments: https://github.com/returntocorp/semgrep/issues/1329
Re: Semgrep: Lightweight static analysis for many languages
#13pip3 install semgrep fails on windows 10 with Python 3.7.8 and pip 20.1.1 and the error seems to be an invalid path separator char. error: can't copy 'XXXXXXXXXXXXXX\Local\Temp\pip-install-cq40rzma\semgrep-files/semgrep-core': doesn't exist or not a regular file Anyone here know how to fix that?
Semgrep should work on Windows Subsystem for Linux (WSL). Mind filing a ticket for myself and the other maintainers to help debug?
https://github.com/returntocorp/semgrep/issues/new?assignees...
Re: Semgrep: Lightweight static analysis for many languages
#14I only recently came across Semgrep and then after that, Comby (https://comby.dev/).
Has anyone compared the 2? They seem similar (structured find/replace, with registries of rules).
Re: Semgrep: Lightweight static analysis for many languages
#15Regexes are such a horrible thing to deal with when you're just trying to parse code quickly and don't want to deal with AST. I've always wished for a library of regexes that just work.
Re: Semgrep: Lightweight static analysis for many languages
#16pip3 install semgrep fails on windows 10 with Python 3.7.8 and pip 20.1.1 and the error seems to be an invalid path separator char. error: can't copy 'XXXXXXXXXXXXXX\Local\Temp\pip-install-cq40rzma\semgrep-files/semgrep-core': doesn't exist or not a regular file Anyone here know how to fix that?
Semgrep should work on Windows Subsystem for Linux (WSL). Mind filing a ticket for myself and the other maintainers to help debug? https://github.com/returntocorp/semgrep/issues/new?assignees...
Done
Re: Semgrep: Lightweight static analysis for many languages
#17I only recently came across Semgrep and then after that, Comby ( https://comby.dev/ ). Has anyone compared the 2? They seem similar (structured find/replace, with registries of rules).
Comby seems more like "parenthesis matching + search" (they don't implement a full parser for the language, just some basic required constructs to make a basic AST. I imagine this limits the resolution of the search?
Semgrep uses an AST that's equivalent to the parser of the language itself so it's much higher resolution in terms of what you can match.
Re: Semgrep: Lightweight static analysis for many languages
#18I work on Semgrep; there are a bunch of examples at https://semgrep.live if you're curious about what the syntax looks like. For context, Semgrep started as a Facebook open-source project inspired from a Inria project named Coccinelle, which has has made a couple thousand or so automatic patches to the Linux kernel over the years using a semantic patch language ( http://coccinelle.lip6.fr/sp.php )
Impressive work!
Are there any plans to include C# or F#?
Re: Semgrep: Lightweight static analysis for many languages
#19We've been using semgrep for Zulip's python codebase for the last few months; here's our configuration: https://github.com/zulip/zulip/blob/master/tools/semgrep.yml I really appreciate the semantic checks. They're especially nice for security-sensitive lint rules, but really it removes the hacky regular expressions feel of adding lint rules to a codebase. It's also been useful for some codebase migrations (semgrep is…
I wonder if this could be improved by extracting fixed strings from the pattern and only actually parsing the files that could possibly match. I think the major issue would be alias support but even that should be possible for most languages as your fixed-string extraction would notice the alias itself.
Re: Semgrep: Lightweight static analysis for many languages
#20We've been using semgrep for Zulip's python codebase for the last few months; here's our configuration: https://github.com/zulip/zulip/blob/master/tools/semgrep.yml I really appreciate the semantic checks. They're especially nice for security-sensitive lint rules, but really it removes the hacky regular expressions feel of adding lint rules to a codebase. It's also been useful for some codebase migrations (semgrep is…
I had a good chuckle at :
> message: "Do not write a SQL injection vulnerability please"