Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Semgrep: Semantic grep for code

semgrep.dev

Post reply on HN
Print view View original

71–80 of 110 posts

Re: Semgrep: Semantic grep for code

#71

Post by theptip »

westurner wrote: post #27

Is there a more complete example of how to call semgrep from pre-commit (which gets called before every git commit) in order to prevent e.g. Python print calls (print(), print \\n(), etc.) from being checked in? https://semgrep.dev/docs/extensions/ describes how to do pre-commit. Nvm, here's semgrep's own .pre-commit-config.yml for semgrep itself: https://github.com/returntocorp/semgrep/blob/develop/.pre-co...

I've never used the `pre-commit` framework, but it's really simple to wire up arbitrary shell scripts; check out the

`.git/hooks` directory in your repo for samples, e.g. `.git/hooks/pre-commit.sample`.

You can run any old shell script there, without having to install a python tool.

Re: Semgrep: Semantic grep for code

#72

Post by alpaca128 »

underyx wrote: post #66
alpaca128 wrote: post #51

Earlier quoted context omitted.

I clicked on this thinking it's a grep that can search code snippets based on language-aware syntax matching instead of regular expressions. Agreed, this project name is misleading about what it does. The name "grep" always indicated some kind of "find a text/pattern and print results to stdout" utility. Like pgrep, which searches running processes by name and then prints their IDs.

> it's a grep that can search code snippets based on language-aware syntax matching instead of regular expressions. Hey, I'm a maintainer of Semgrep, and this sounds like a pretty good description of what the CLI can do, see this example for finding all function/class/method calls: $ semgrep -e '$NAME(...)' -l python flask_todomvc/extensions.py 4:db = SQLAlchemy() -----------------------------------------------------…

Oh, that's great to see. The website's presentation made a different impression with its "enforce code standards" angle.

Looks like a pretty useful tool with a couple nice options. A bit strange that the `-e` option is only explained on the website, but to be fair it seems to be a lot to cover. Still, a kind of "cheat sheet" style summary in the help message would be fantastic, just as a little suggestion.

Re: Semgrep: Semantic grep for code

#73

Post by prepend »

IshKebab wrote: post #60
prepend wrote: post #50

Earlier quoted context omitted.

I’m always surprised at stuff I take for granted that doesn’t work on Windows. So yeah, it seems like cross-platform should be easy but since my dev environment is zsh, it’s easy for my stuff to work sort of “everywhere but Windows.” Add to that that the reason things fail on Windows is usually something Windows specific and “their fault.” So it’s unusual for me to fire up a Windows VM just to sanity check my code. A…

This is an open source project on Github. They can use Github Actions which has free runners for Windows, Mac and Linux.

Windows runners consume 2x minutes, Mac runners consume 10x minutes [0].

Free projects only get 2,000 minutes per month so running on all three platforms means you only get 1/13th of the minutes of only using Linux.

I rarely use anything but Linux runners even on my paid projects. I like saving money, so unless I really need integration testing on Windows or Mac, I don’t do it.

[0] https://docs.github.com/en/github/setting-up-and-managing-bi...

Re: Semgrep: Semantic grep for code

#76

Post by pabs3 »

Does it come with a standard set of rules that finds bad code without any false positives out of the box? Or is it more of a tool for people doing code security audits & pentesting who know what they are looking for and want to read the surrounding code?

Re: Semgrep: Semantic grep for code

#77

Post by realquadrant »

Hi, this is very cool. I have been building up a suite of tools to roll out across major open source projects to improve security. I like what I have seen so far, this is a great use case. Whom can I connect with to learn more? And similarity/diff with sourcegraph, also like a lot.

Re: Semgrep: Semantic grep for code

#78

Post by joshuamorton »

tyingq wrote: post #53
aseipp wrote: post #52

Earlier quoted context omitted.

> If it were really looking at AST level data, that wouldn't have fooled it. Semgrep does look at an AST; but that counterexample is not something you can "fix" solely by looking at an AST. You need actual Python-specific semantic analysis that knows that all "open" functions like 'print' come from the builtins module, and thus are bound to the same identifier. They're literally built into the implementation, it's no…

>Semgrep does look at an AST; but that counterexample is not something you can "fix" solely by looking at an AST Perhaps I worded it poorly. Dumping the python AST for builtins.print() makes it pretty clear that it's "print" though. So I'm curious why that skirts the rule. >I mean, nobody seems to be suggesting this though Not specificially, but the context is using it for security purposes with phrases like "every u…

> Perhaps I worded it poorly. Dumping the python AST for builtins.print() makes it pretty clear that it's "print" though. So I'm curious why that skirts the rule.

To echo the other replies, the AST for builtins.print() is the same as the ast for mymodule.print() and, in fact, if you stick a builtins.py in the right place, you'll be able to prevent the import of the standard library builtin module, while the ast's would be identical.

Re: Semgrep: Semantic grep for code

#79

Post by minusf »

probably doing something wrong but running the ci ruleset on a tiny django hobby project made all cores spin at 100% after 33% of the progress bar and made the OS almost unresponsive. ctrl-c after 5 minutes and i still had to pkill every semgrep process... never seen the M1 airbook overheat this much before.

Re: Semgrep: Semantic grep for code

#80

Post by hn_throwaway_99 »

avodonosov wrote: post #59
hn_throwaway_99 wrote: post #39

I currently use a highly opinionated ESLint config (based on the airbnb one) together with strict checking in my TypeScript config, and it is configured to run on every commit with husky git hooks. The example given on the Semgrep homepage is an exact match to one that exists in my ESLint config (eslint's no-console rule). How does Semgrep compare to ESLint+a strict tsconfig?

How do you deal with false positives? If the commit hook rejects anything where rules are triggered, a way to force the comrit is needed for the cases when the rule finding is not reanny an issue. Upd: I found that the --no-verify option can be used in many cases

You can put comments in the code to ignore eslint rules on a specific line, or for the whole file.
Post reply on HN