Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Semgrep: Semantic grep for code

semgrep.dev

Post reply on HN
Print view View original

101–110 of 110 posts

Re: Semgrep: Semantic grep for code

#101

Post by karlding »

brundolf wrote: post #44
hyper_reality wrote: post #22

This is an excellent tool to have as a security consultant, and it just keeps getting better and better. When approaching a large codebase, it enables you to write custom rules that match on certain antipatterns you've spotted that may be unique to the codebase. That's the real value of the tool, but the repository of per-language rules is also convenient for quickly finding low-hanging fruit (like every use of a pot…

I'm honestly surprised we haven't seen complete democratization of linting/grepping/refactoring tools. Imagine being able to script a one-off refactor you want to make that's too project-specific to be included in the IDE itself. Writing the parser is nontrivial, but once you have it it should be straightforward to expose a programmatic API for doing this stuff instead of trying to hardcode every useful linter rule i…

For C/C++ code, you can already do refactoring using clang-tidy scripts [0], or even can write custom linters using libtooling [1] and leverage the AST Matchers [2] which work at the AST level.

All that's needed is a compile_commands.json file which can be easily generated via most build systems, or you can use Bear [3]/some other tool (or write a script that logs all syscalls and generate it yourself).

[0] https://releases.llvm.org/12.0.0/tools/clang/tools/extra/doc...

[1] https://releases.llvm.org/12.0.0/tools/clang/docs/LibTooling...

[2] https://releases.llvm.org/12.0.0/tools/clang/docs/LibASTMatc...

[3] https://github.com/rizsotto/Bear

Re: Semgrep: Semantic grep for code

#105

Post by elanning »

brundolf wrote: post #44
hyper_reality wrote: post #22

This is an excellent tool to have as a security consultant, and it just keeps getting better and better. When approaching a large codebase, it enables you to write custom rules that match on certain antipatterns you've spotted that may be unique to the codebase. That's the real value of the tool, but the repository of per-language rules is also convenient for quickly finding low-hanging fruit (like every use of a pot…

I'm honestly surprised we haven't seen complete democratization of linting/grepping/refactoring tools. Imagine being able to script a one-off refactor you want to make that's too project-specific to be included in the IDE itself. Writing the parser is nontrivial, but once you have it it should be straightforward to expose a programmatic API for doing this stuff instead of trying to hardcode every useful linter rule i…

I wrote a small VS code extension and pre-commit hook that might meet 80% of your needs:

https://github.com/elanning/checkr

It is just simple regex at this time, but hopefully I can add something like CCGrep syntax in the future:

https://github.com/yuy-m/CCGrep

Re: Semgrep: Semantic grep for code

#107

Post by westurner »

joj123 wrote: post #95
Spivak wrote: post #88

Earlier quoted context omitted.

If you can catch it before the commit is even made then why do/wait for a build?

Fair enough. Guess IDE plugins work even better for that

IDE plugins are not at all consistent from one IDE to another. Pre-commit is great for teams with different IDEs because all everyone needs to do is:

  [pip,] install pre-commit
  pre-commit install
  # git commit
  #   pre-commit run --all-files

  # pre-commit autoupdate
https://pre-commit.com/

Re: Semgrep: Semantic grep for code

#108

Post by westurner »

theptip wrote: post #71
westurner wrote: post #27

Is there a more complete example of how to call semgrep from pre-commit (which gets called before every git commit) in order to prevent e.g. Python print calls (print(), print \\n(), etc.) from being checked in? https://semgrep.dev/docs/extensions/ describes how to do pre-commit. Nvm, here's semgrep's own .pre-commit-config.yml for semgrep itself: https://github.com/returntocorp/semgrep/blob/develop/.pre-co...

I've never used the `pre-commit` framework, but it's really simple to wire up arbitrary shell scripts; check out the `.git/hooks` directory in your repo for samples, e.g. `.git/hooks/pre-commit.sample`. You can run any old shell script there, without having to install a python tool.

Yeah but that githook will only be installed on that one repo on that one machine. And they may have no or a different version of bash installed (on e.g. MacOS or Windows). IMHO, POSIX-compatible portable shell scripts are more trouble than portable Python scripts.

Pre-commit requires Python and pre-commit to be installed (and then it downloads every hook function).

This fetches the latest version of every hook defined in the .pre-commit-config.yml:

  pre-commit autoupdate
https://pre-commit.com/#pre-commit-autoupdate

A person could easily `ln -s repo/.hooks/hook*.sh repo/.git/hooks/` after every git clone.

Re: Semgrep: Semantic grep for code

#109

Post by da39a3ee »

hyper_reality wrote: post #22

This is an excellent tool to have as a security consultant, and it just keeps getting better and better. When approaching a large codebase, it enables you to write custom rules that match on certain antipatterns you've spotted that may be unique to the codebase. That's the real value of the tool, but the repository of per-language rules is also convenient for quickly finding low-hanging fruit (like every use of a pot…

Isn't a problem here that, since there's no simple definition of what it's doing, there's no simple way to assess your false negative rate when searching for something? That is fine for many pragmatic informal uses but doesn't seem a good fit for security purposes.

Re: Semgrep: Semantic grep for code

#110

Post by IshKebab »

prepend wrote: post #73
IshKebab wrote: post #60

Earlier quoted context omitted.

This is an open source project on Github. They can use Github Actions which has free runners for Windows, Mac and Linux.

Windows runners consume 2x minutes, Mac runners consume 10x minutes [0]. Free projects only get 2,000 minutes per month so running on all three platforms means you only get 1/13th of the minutes of only using Linux. I rarely use anything but Linux runners even on my paid projects. I like saving money, so unless I really need integration testing on Windows or Mac, I don’t do it. [0] https://docs.github.com/en/github/s…

The 2000 minute limit only applies to private projects.
Post reply on HN