Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Semgrep: Semantic grep for code

semgrep.dev

Post reply on HN
Print view View original

91–100 of 110 posts

Re: Semgrep: Semantic grep for code

#91

Post by mdaniel »

Spivak wrote: post #89
wdb wrote: post #81

Apparently this is invalid TypeScript (cannot parse it says): try { const parsedURL = new URL(url) requestPath = parsedURL.pathname } catch (error: unknown) { // NOOP } It's complaining about : unknown bit which one of the newer typescript eslint rules enforces.

Apparently import random if random.randint(0,1) == 2: print(“hello”) Is also unparseable.

is that due to the smartquotes, or that's just an artifact of your HN comment?

Perhaps a more pointed set of questions: what is the error it emits, and have you considered submitting that case as an actual bug?

Re: Semgrep: Semantic grep for code

#92

Post by mdaniel »

enriquto wrote: post #11
thomasahle wrote: post #6

Earlier quoted context omitted.

The cli is here: https://semgrep.dev/docs/getting-started/ You can write stuff like # Check for Python == where the left and right hand sides are the same (often a bug) $ semgrep -e '$X == $X' --lang=py path/to/src

Cool! But this example is a bit simplistic since it can be done just as easily by regular grep: grep -E '(.+) = \1' *.py I have trouble looking at the examples in the project website (many things inside iframes are adblocked). Do you have any example of a search that would be difficult or impossible with grep?

Your example matches the _text_, semgrep matches _the language_

given:

    if 1 \
        == \
        1:
        pass
then

    $ semgrep -e '$X == $X' -l python
    1:if 1 \
    2:        == \
    3:        1:
    ran 1 rules on 1 files: 1 findings
to follow myself up, one can also check for expressions like what I used as an example and say "don't do that", but without regard to what is inside the if

    semgrep -e $'if ...:\n  pass\n' -l python

Re: Semgrep: Semantic grep for code

#93

Post by mdaniel »

afro88 wrote: post #54

No swift support yet. What would be involved in adding it?

https://github.com/returntocorp/ocaml-tree-sitter/blob/maste... appears to be the general answer to your question, but navigating to the tree-sitter docs shows that tree-sitter has one in progress: https://github.com/tree-sitter/tree-sitter-swift so hopefully the machinery to incorporate it into semgrep will not be horrific

Re: Semgrep: Semantic grep for code

#95

Post by joj123 »

Spivak wrote: post #88
joj123 wrote: post #86

Earlier quoted context omitted.

Out of curiosity, Is there value in doing this over (say) running a GitHub Action post commit and failing the build if it finds something nasty?

If you can catch it before the commit is even made then why do/wait for a build?

Fair enough. Guess IDE plugins work even better for that

Re: Semgrep: Semantic grep for code

#96

Post by rmetzler »

rmetzler wrote: post #26

Looks like a useful tool for me and I would like to try it. Go down, see "brew install semgrep" and try to copy paste it. And it's an image :(

There is also a bug in the example rules single pages app.

Go to https://semgrep.dev/p/jwt

Go to the page 2/5

Click "Run Locally", so you can copy the code

close the modal -> you're on page 1/5. Expectation would be to stay on page 2/5.

It would also be very useful to be able to filter by language and topic.

Re: Semgrep: Semantic grep for code

#97

Post by Annatar »

I click on the link above and I get a seemingly blank page, all because the website uses some JavaScript garbage and violates W3C standards. That's the ridiculous, disgusting state of the information technology industry in the 21st century. I rue the day I decided to do this professionally, and I am deeply ashamed and despondent.

Re: Semgrep: Semantic grep for code

#98

Post by nojvek »

The underlying package tree-sitter that semgrep uses is pretty amazing too. It’s an incremental parser for many different languages written in C.

It blows my mind how fast it is compared to many tools in js ecosystem. Tree-sitter was parsing millions of files in half a minute. JS, TS, Ruby, yaml, html, Css. It’s quite magical. Such great engineering.

Re: Semgrep: Semantic grep for code

#100

Post by iddan »

shuringai wrote: post #82
underyx wrote: post #66

Earlier quoted context omitted.

> it's a grep that can search code snippets based on language-aware syntax matching instead of regular expressions. Hey, I'm a maintainer of Semgrep, and this sounds like a pretty good description of what the CLI can do, see this example for finding all function/class/method calls: $ semgrep -e '$NAME(...)' -l python flask_todomvc/extensions.py 4:db = SQLAlchemy() -----------------------------------------------------…

question, you mention "no more AST parsing" as a selling line for semgrep. Isn't this actually a bad thing for a staric analyzer, as ASTs are actually... abstract, and closer to the real logic of what the code does? I know analyzing text is faster but is it worth?

The tool abstracts away the AST with a more intuitive, human friendly interface. Similarly to how Regular Expressions do for strings matching logic
Post reply on HN