Introducing Semgrep and r2c
r2c.dev
Introducing Semgrep and r2c
1–10 of 23 posts
Re: Introducing Semgrep and r2c
#2We've been working with the r2c folks for a while, and been using semgrep since before it was called semgrep.
If you can write code in a language, you can use semgrep. It also has a feature I have learned to love every time I find it in any kind of auditing tool: it’s ruthlessly effective as an exploratory and experimental tool, but it takes no effort at all to turn that into a persistent check. By comparison: ripgrep finds anything fast, but nobody uses it to write linters. Other off the shelf linters do a great job finding (simple) issues, but bandit doesn’t help me one bit to build a mental map of how a codebase works.
Re: Introducing Semgrep and r2c
#3I would love this in my editor: if I search for
day = 'friday'
I want it to find
day="friday"
also!
Re: Introducing Semgrep and r2c
#4Hey HN, I’m the author of this post and a contributor to Semgrep. Happy to answer questions and hear feedback! I’m excited to try to lower the barrier to writing a simple lint (or more complex program analysis) that previously only a static analysis expert could do; we’ve gotten contributions from people who don’t know what an abstract syntax tree is! The userbase for Semgrep is almost evenly split between security engineers using it for hunting/enforcement and developers looking for bugs; we’ve tried to collect examples for both use cases at https://semgrep.dev/explore.
Re: Introducing Semgrep and r2c
#5I would love this in my editor: if I search for day = 'friday' I want it to find day="friday" also!
This is actually a great idea.
Re: Introducing Semgrep and r2c
#6Hey HN, I’m the author of this post and a contributor to Semgrep. Happy to answer questions and hear feedback! I’m excited to try to lower the barrier to writing a simple lint (or more complex program analysis) that previously only a static analysis expert could do; we’ve gotten contributions from people who don’t know what an abstract syntax tree is! The userbase for Semgrep is almost evenly split between security e…
First of all, I love the idea of semgrep, but can't use it since we're using C++. Is there any chance for C++ support in the future?
Re: Introducing Semgrep and r2c
#7I would love this in my editor: if I search for day = 'friday' I want it to find day="friday" also!
If you use VSCode you can get that today, if you use something else it doesn't look too hard to write: https://semgrep.dev/docs/integrations/#editor
I'd expect latency might be juuust in the range where it doesn't feel interactive yet? But honestly any search that isn't ripgrep or --omg-optimized-etags feels like that to me now, and people use symbol rename features in IDEs all the time that take multiple seconds, so maybe I'm just unreasonably picky.
Re: Introducing Semgrep and r2c
#8Hey HN, I’m the author of this post and a contributor to Semgrep. Happy to answer questions and hear feedback! I’m excited to try to lower the barrier to writing a simple lint (or more complex program analysis) that previously only a static analysis expert could do; we’ve gotten contributions from people who don’t know what an abstract syntax tree is! The userbase for Semgrep is almost evenly split between security e…
First of all, I love the idea of semgrep, but can't use it since we're using C++. Is there any chance for C++ support in the future?
Not GP, but one the one hand semgrep has a real honest to goodness parser at its core; on the other hand I'd expect C++ to have sufficiently complicated semantics that it needs some understanding of C++ specific mechanics to be useful. Furthermore, you'd need preprocessor and template expansion magic to really get to the bottom of it. Effectively this is the same problem e.g. javacpp has.
Re: Introducing Semgrep and r2c
#9Hey HN, I’m the author of this post and a contributor to Semgrep. Happy to answer questions and hear feedback! I’m excited to try to lower the barrier to writing a simple lint (or more complex program analysis) that previously only a static analysis expert could do; we’ve gotten contributions from people who don’t know what an abstract syntax tree is! The userbase for Semgrep is almost evenly split between security e…
First of all, I love the idea of semgrep, but can't use it since we're using C++. Is there any chance for C++ support in the future?
The good news is that we’ve replaced almost all the homegrown parsers that were written while the tool was at Facebook and we’re using the now tree-sitter project, which already has parsers for 40+ languages. There is a tree-sitter-cpp project we can and will eventually integrate! The bad news is this requires the code to not use heavily macros to be parseable as-is. So really the difficulty is not C++ but rather the pre-processor.
Re: Introducing Semgrep and r2c
#10Earlier quoted context omitted.
First of all, I love the idea of semgrep, but can't use it since we're using C++. Is there any chance for C++ support in the future?
The good news is that we’ve replaced almost all the homegrown parsers that were written while the tool was at Facebook and we’re using the now tree-sitter project, which already has parsers for 40+ languages. There is a tree-sitter-cpp project we can and will eventually integrate! The bad news is this requires the code to not use heavily macros to be parseable as-is. So really the difficulty is not C++ but rather the…
That sounds really cool, would it be possible to ignore the macros or can the code not be parsed at all then?