Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Semgrep: Semantic grep for code

semgrep.dev

Post reply on HN
Print view View original

11–20 of 110 posts

Re: Semgrep: Semantic grep for code

#11

Post by enriquto »

thomasahle wrote: post #6
enriquto wrote: post #3

> You need to enable JavaScript to run this app. Wait, is this a web app? I was expecting a command line tool to navigate my code locally.

The cli is here: https://semgrep.dev/docs/getting-started/ You can write stuff like # Check for Python == where the left and right hand sides are the same (often a bug) $ semgrep -e '$X == $X' --lang=py path/to/src

Cool! But this example is a bit simplistic since it can be done just as easily by regular grep:

    grep -E '(.+) = \1' *.py
I have trouble looking at the examples in the project website (many things inside iframes are adblocked). Do you have any example of a search that would be difficult or impossible with grep?

Re: Semgrep: Semantic grep for code

#13

Post by jhgb »

ievans wrote: post #9
jhgb wrote: post #2

Isn't "grep for code" called just "grep"?

Semgrep started off as a “syntactic grep” but has increasingly become more semantic. So if you want to find all calls to foo that have 1 as the first argument, you just search for foo(1) and even things like x = 1; foo(x); will match. Here’s an elaborate example: https://semgrep.dev/s/ievans:c-dataflow

That's called "a code walker", isn't it?

Re: Semgrep: Semantic grep for code

#14

Post by SavantIdiot »

enriquto wrote: post #11
thomasahle wrote: post #6

Earlier quoted context omitted.

The cli is here: https://semgrep.dev/docs/getting-started/ You can write stuff like # Check for Python == where the left and right hand sides are the same (often a bug) $ semgrep -e '$X == $X' --lang=py path/to/src

Cool! But this example is a bit simplistic since it can be done just as easily by regular grep: grep -E '(.+) = \1' *.py I have trouble looking at the examples in the project website (many things inside iframes are adblocked). Do you have any example of a search that would be difficult or impossible with grep?

It can infer (x==y) if x=1 and y=1, which is grep cannot do.

Re: Semgrep: Semantic grep for code

#15

Post by SavantIdiot »

Since the capability has never existed, I don't think in terms of being able to semgrep. If that makes any sense. My brain is not wired this way, yet.

Like, if you've never tasted lychee, it would never occur to you how to cook with it.

I'm going to need to see some useful, real-world examples to jumpstart my brain to think this way.

Re: Semgrep: Semantic grep for code

#16

Post by enriquto »

SavantIdiot wrote: post #14
enriquto wrote: post #11

Earlier quoted context omitted.

Cool! But this example is a bit simplistic since it can be done just as easily by regular grep: grep -E '(.+) = \1' *.py I have trouble looking at the examples in the project website (many things inside iframes are adblocked). Do you have any example of a search that would be difficult or impossible with grep?

It can infer (x==y) if x=1 and y=1, which is grep cannot do.

This must surely fail... isn't it equivalent to solving the halting problem? Or does it run the whole program like a debugger?

Re: Semgrep: Semantic grep for code

#17

Post by fragmede »

enriquto wrote: post #11
thomasahle wrote: post #6

Earlier quoted context omitted.

The cli is here: https://semgrep.dev/docs/getting-started/ You can write stuff like # Check for Python == where the left and right hand sides are the same (often a bug) $ semgrep -e '$X == $X' --lang=py path/to/src

Cool! But this example is a bit simplistic since it can be done just as easily by regular grep: grep -E '(.+) = \1' *.py I have trouble looking at the examples in the project website (many things inside iframes are adblocked). Do you have any example of a search that would be difficult or impossible with grep?

If you're that capable with grep, surely you've run into it's shortcomings and can appreciate attempts to improve the status quo. Like trying to find usages of a variable that is a substring of a word. Like trying to fix code where somebody else has used the variable name i. Sure, you can add matching on word boundaries, but then it starts to become a distraction from the original task at hand.

Re: Semgrep: Semantic grep for code

#19

Post by underyx »

SavantIdiot wrote: post #15

Since the capability has never existed, I don't think in terms of being able to semgrep. If that makes any sense. My brain is not wired this way, yet. Like, if you've never tasted lychee, it would never occur to you how to cook with it. I'm going to need to see some useful, real-world examples to jumpstart my brain to think this way.

Hey, I work on Semgrep. As a real world example, I just noticed today that Hashicorp uses a whole bunch of Semgrep rules on terraform-provider-aws[0]. I'd recommend reading the `message` keys to know what they intend to match, and then the `patterns` lists below to see how that's accomplished.

Alternatively, we curate 1000+ community rules that you can look through as well.[1]

[0]: https://github.com/hashicorp/terraform-provider-aws/blob/mai...

[1]: https://semgrep.dev/r

Re: Semgrep: Semantic grep for code

#20

Post by Quekid5 »

enriquto wrote: post #16
SavantIdiot wrote: post #14

Earlier quoted context omitted.

It can infer (x==y) if x=1 and y=1, which is grep cannot do.

This must surely fail... isn't it equivalent to solving the halting problem? Or does it run the whole program like a debugger?

If false negatives are permitted the halting problem isn't an issue.
Post reply on HN