21–29 of 29 posts
Has anyone done something like this, or am I riding the 2016 neural net hype train still?
Just went through the examples. Seems really intuitive and looks like it would be a good approach for homegrown linters. Would also love to see some plugin support for editors.
Agreed. What editors do you have in mind? I filed a ticket for VS Code support because I’ve seen it mentioned in a few of the other comments: https://github.com/returntocorp/semgrep/issues/1329
We've been using semgrep for Zulip's python codebase for the last few months; here's our configuration: https://github.com/zulip/zulip/blob/master/tools/semgrep.yml I really appreciate the semantic checks. They're especially nice for security-sensitive lint rules, but really it removes the hacky regular expressions feel of adding lint rules to a codebase. It's also been useful for some codebase migrations (semgrep is…
I wonder if this could be improved by extracting fixed strings from the pattern and only actually parsing the files that could possibly match. I think the major issue would be alias support but even that should be possible for most languages as your fixed-string extraction would notice the alias itself.
I only recently came across Semgrep and then after that, Comby ( https://comby.dev/ ). Has anyone compared the 2? They seem similar (structured find/replace, with registries of rules).
Comby seems more like "parenthesis matching + search" (they don't implement a full parser for the language, just some basic required constructs to make a basic AST. I imagine this limits the resolution of the search? Semgrep uses an AST that's equivalent to the parser of the language itself so it's much higher resolution in terms of what you can match.
That explains why too that Comby supports so many languages so easily, and how easy it is to add your own DSL.
I work on Semgrep; there are a bunch of examples at https://semgrep.live if you're curious about what the syntax looks like. For context, Semgrep started as a Facebook open-source project inspired from a Inria project named Coccinelle, which has has made a couple thousand or so automatic patches to the Linux kernel over the years using a semantic patch language ( http://coccinelle.lip6.fr/sp.php )
Impressive work! Are there any plans to include C# or F#?
I only recently came across Semgrep and then after that, Comby ( https://comby.dev/ ). Has anyone compared the 2? They seem similar (structured find/replace, with registries of rules).
I've always wondered if we could leverage the vast amount of GitHub code - that assumably all compiles without error or undefined behaviour on their master branches - train some sort of neural net to better catch syntax errors. Has anyone done something like this, or am I riding the 2016 neural net hype train still?
TabNine was acquired by Codota earlier this year [2].
[1] https://www.tabnine.com/blog/deep/
[2] https://techcrunch.com/2020/04/27/codota-picks-up-12m-for-an...
I've always wondered if we could leverage the vast amount of GitHub code - that assumably all compiles without error or undefined behaviour on their master branches - train some sort of neural net to better catch syntax errors. Has anyone done something like this, or am I riding the 2016 neural net hype train still?
This isn't specifically for syntax errors, but Jacob Jackson released TabNine [0] last year, which is an autocompleter trained on files from GitHub [1]. TabNine was acquired by Codota earlier this year [2]. [0] https://www.tabnine.com/ [1] https://www.tabnine.com/blog/deep/ [2] https://techcrunch.com/2020/04/27/codota-picks-up-12m-for-an...
I work on Semgrep; there are a bunch of examples at https://semgrep.live if you're curious about what the syntax looks like. For context, Semgrep started as a Facebook open-source project inspired from a Inria project named Coccinelle, which has has made a couple thousand or so automatic patches to the Linux kernel over the years using a semantic patch language ( http://coccinelle.lip6.fr/sp.php )
Impressive work! Are there any plans to include C# or F#?