Typo in the "Trying Semgrep" screenshot ("ruleste"): https://semgrep.dev/static/media/Step1.df848497.png
Semgrep: Semantic grep for code
21–30 of 110 posts
Re: Semgrep: Semantic grep for code
#22This is an excellent tool to have as a security consultant, and it just keeps getting better and better. When approaching a large codebase, it enables you to write custom rules that match on certain antipatterns you've spotted that may be unique to the codebase. That's the real value of the tool, but the repository of per-language rules is also convenient for quickly finding low-hanging fruit (like every use of a potentially injectable function such as exec,system,etc. in PHP).
For example, a webapp may have been designed such that authorisation needs to be explicitly added with a line or two to each controller. A semgrep rule can be written to match all the controllers which are missing this line. Then these controllers can be manually reviewed to assess whether unauthorised access should be allowed. Depending on what you are trying to match, this is something that may be very complex or even impossible to implement accurately in plain grep. Some languages like Ruby have powerful static analysis tools (Brakeman) that can also do this, but the benefit of Semgrep is the flexibility across multiple languages and how readable the rulesets are. [1]
[1] https://blog.includesecurity.com/2021/01/custom-static-analy...
Re: Semgrep: Semantic grep for code
#23Isn't "grep for code" called just "grep"?
Semgrep started off as a “syntactic grep” but has increasingly become more semantic. So if you want to find all calls to foo that have 1 as the first argument, you just search for foo(1) and even things like x = 1; foo(x); will match. Here’s an elaborate example: https://semgrep.dev/s/ievans:c-dataflow
It does seem potentially good for enforcing standards where the participants are willing. But you can work around it fairly easily. Like the example "python no-prints" rule: https://semgrep.dev/s/sabihb:no-prints
Lots of workarounds it wouldn't find, like:
import builtins
builtins.print("whee")Re: Semgrep: Semantic grep for code
#24Earlier quoted context omitted.
It can infer (x==y) if x=1 and y=1, which is grep cannot do.
This must surely fail... isn't it equivalent to solving the halting problem? Or does it run the whole program like a debugger?
It fails pretty fast.
import random
y = 0
def f(x):
print(x)
if random.randint(0,1) == 2:
y = 1
f(y)
Re: Semgrep: Semantic grep for code
#25The name "Semantic Grep" does not give a good idea for what this tool is and what it does.
The web page states: "Static analysis at ludicrous speed. Find bugs and enforce code standards"
"grep" is short for "global regular expression print". It finds matches for the given regular expression and prints them.
"Semantic Grep" is a static analyzer with configurable rules, style checks, etc. It does much more than search and print.
Perhaps a better name is needed?
Edit: How about "omnilint" or "omnicritic" since semgrep is more of a "lint" (https://en.wikipedia.org/wiki/Lint_(software)) or "critic" (https://en.wikipedia.org/wiki/Perl::Critic) type of tool that handles multiple languages?
Edit2: "Static analysis at ludicrous speed" ==> "turbolint"? ("ludicrous speed" reminds of the hilarious Space Balls scene :) "turbolint, GO!"
Re: Semgrep: Semantic grep for code
#26Looks like a useful tool for me and I would like to try it.
Go down, see "brew install semgrep" and try to copy paste it. And it's an image :(
Re: Semgrep: Semantic grep for code
#27Is there a more complete example of how to call semgrep from pre-commit (which gets called before every git commit) in order to prevent e.g. Python print calls (print(), print \\n(), etc.) from being checked in?
https://semgrep.dev/docs/extensions/ describes how to do pre-commit.
Nvm, here's semgrep's own .pre-commit-config.yml for semgrep itself: https://github.com/returntocorp/semgrep/blob/develop/.pre-co...
Re: Semgrep: Semantic grep for code
#28No Windows support yet: https://github.com/returntocorp/semgrep/issues/1330
Re: Semgrep: Semantic grep for code
#29Just the tool that I was looking for. We are looking to do Service linting in our organization as a method of making sure our services don't drift too far apart.
Anyone else know of a Service linting tool? OPA/conftest come close but lack syntax parsers for Ruby/Javascript.
Re: Semgrep: Semantic grep for code
#30Earlier quoted context omitted.
Semgrep started off as a “syntactic grep” but has increasingly become more semantic. So if you want to find all calls to foo that have 1 as the first argument, you just search for foo(1) and even things like x = 1; foo(x); will match. Here’s an elaborate example: https://semgrep.dev/s/ievans:c-dataflow
It does seem potentially good for enforcing standards where the participants are willing. But you can work around it fairly easily. Like the example "python no-prints" rule: https://semgrep.dev/s/sabihb:no-prints Lots of workarounds it wouldn't find, like: import builtins builtins.print("whee")
I'm guessing the value with the rules system is, you can add new rules easily. So during a code review, if you see somebody using your example, you could create a new rule to catch that.
I don't think you can go in with the mindset that it will catch everything, but rather, it's about being able to iterate quickly with your rules.