Semgrep: Writing quick rules to verify ideas
blog.deesee.xyz
Semgrep: Writing quick rules to verify ideas
1–10 of 20 posts
Re: Semgrep: Writing quick rules to verify ideas
#2I use semgrep for semantic search (and replace, sometimes).
Their docs and website try very hard to suggest you should use it for some kind of CI process, but so far I haven't found any need to do so. I can maybe see it being useful in a pre-commit hook.
It's VERY handy for semantic searches though - in situations where ripgrep would be useless due to multi-line matches.
I set up this alias to make it a bit less verbose for Python patterns:
pygrep () {
pat="$1"
shift
filez="$*"
bash -xc "semgrep --lang=python --pattern '$pat' $filez"
}
pygrep 'myfunc(..., needle_arg=..., ...)'Re: Semgrep: Writing quick rules to verify ideas
#3I use semgrep for semantic search (and replace, sometimes). Their docs and website try very hard to suggest you should use it for some kind of CI process, but so far I haven't found any need to do so. I can maybe see it being useful in a pre-commit hook. It's VERY handy for semantic searches though - in situations where ripgrep would be useless due to multi-line matches. I set up this alias to make it a bit less verb…
Don't you have to shift the arguments, so that `$1` does not also end in `filez`?
Re: Semgrep: Writing quick rules to verify ideas
#4I use semgrep for semantic search (and replace, sometimes). Their docs and website try very hard to suggest you should use it for some kind of CI process, but so far I haven't found any need to do so. I can maybe see it being useful in a pre-commit hook. It's VERY handy for semantic searches though - in situations where ripgrep would be useless due to multi-line matches. I set up this alias to make it a bit less verb…
Heya, Semgrep maintainer here. Just wanted to ask you about an idea I had before, how would you feel about specifying the language parameter in the binary name, making the invocation look like this?
semgrep.py search 'myfunc(..., needle_arg=..., ...)'
semgrep scan --config auto
semgrep ci
Re: Semgrep: Writing quick rules to verify ideas
#5I use semgrep for semantic search (and replace, sometimes). Their docs and website try very hard to suggest you should use it for some kind of CI process, but so far I haven't found any need to do so. I can maybe see it being useful in a pre-commit hook. It's VERY handy for semantic searches though - in situations where ripgrep would be useless due to multi-line matches. I set up this alias to make it a bit less verb…
Note that ripgrep can do multi-line searches with the -U flag.
Not that this detracts from your main point. Semgrep is much smarter than ripgrep and goes well beyond multi line searches.
I just wanted to clarify the small thing.
Re: Semgrep: Writing quick rules to verify ideas
#6I use semgrep for semantic search (and replace, sometimes). Their docs and website try very hard to suggest you should use it for some kind of CI process, but so far I haven't found any need to do so. I can maybe see it being useful in a pre-commit hook. It's VERY handy for semantic searches though - in situations where ripgrep would be useless due to multi-line matches. I set up this alias to make it a bit less verb…
Heya, Semgrep maintainer here. Just wanted to ask you about an idea I had before, how would you feel about specifying the language parameter in the binary name, making the invocation look like this? semgrep.py search 'myfunc(..., needle_arg=..., ...)' And then the other subcommands would remain semgrep scan --config auto to scan with all recommended rules and semgrep ci to scan in CI jobs.
I feel like the „semgrep.py“ idea is not that good, because someone could legitimately have a semgrep.py or semgrep.js or similar file which wraps semgrep.
Edit: thanks for maintaining semgrep, started using it heavily in day job and the team started writing Frontends for it.
Re: Semgrep: Writing quick rules to verify ideas
#7I use semgrep for semantic search (and replace, sometimes). Their docs and website try very hard to suggest you should use it for some kind of CI process, but so far I haven't found any need to do so. I can maybe see it being useful in a pre-commit hook. It's VERY handy for semantic searches though - in situations where ripgrep would be useless due to multi-line matches. I set up this alias to make it a bit less verb…
Heya, Semgrep maintainer here. Just wanted to ask you about an idea I had before, how would you feel about specifying the language parameter in the binary name, making the invocation look like this? semgrep.py search 'myfunc(..., needle_arg=..., ...)' And then the other subcommands would remain semgrep scan --config auto to scan with all recommended rules and semgrep ci to scan in CI jobs.
>> Their docs and website try very hard to suggest you should use it for some kind of CI process...
Just a piece of feedback for the record: I have been stuck in exactly the same place the few times I was interested in trying out a ripgrep alternative that understood semantics, but didn't have such an urgent need to actually understand how to get things going.
Re: Semgrep: Writing quick rules to verify ideas
#8Earlier quoted context omitted.
Heya, Semgrep maintainer here. Just wanted to ask you about an idea I had before, how would you feel about specifying the language parameter in the binary name, making the invocation look like this? semgrep.py search 'myfunc(..., needle_arg=..., ...)' And then the other subcommands would remain semgrep scan --config auto to scan with all recommended rules and semgrep ci to scan in CI jobs.
I feel like the „semgrep.py“ idea is not that good, because someone could legitimately have a semgrep.py or semgrep.js or similar file which wraps semgrep. Edit: thanks for maintaining semgrep, started using it heavily in day job and the team started writing Frontends for it.
If someone had such a wrapper, I'd expect if it's globally available in $PATH then it'd have a more descriptive name, and if it's not in $PATH, then you'd likely run it as `python semgrep.py` or `./semgrep.py`. Does that sound right to you?
Re: Semgrep: Writing quick rules to verify ideas
#9Earlier quoted context omitted.
Heya, Semgrep maintainer here. Just wanted to ask you about an idea I had before, how would you feel about specifying the language parameter in the binary name, making the invocation look like this? semgrep.py search 'myfunc(..., needle_arg=..., ...)' And then the other subcommands would remain semgrep scan --config auto to scan with all recommended rules and semgrep ci to scan in CI jobs.
>> Their docs and website try very hard to suggest you should use it for some kind of CI process... Just a piece of feedback for the record: I have been stuck in exactly the same place the few times I was interested in trying out a ripgrep alternative that understood semantics, but didn't have such an urgent need to actually understand how to get things going.
Thanks! Could you let me know what you'd change on our Getting Started[0] page to explain the CLI usage better?
Re: Semgrep: Writing quick rules to verify ideas
#10I use semgrep for semantic search (and replace, sometimes). Their docs and website try very hard to suggest you should use it for some kind of CI process, but so far I haven't found any need to do so. I can maybe see it being useful in a pre-commit hook. It's VERY handy for semantic searches though - in situations where ripgrep would be useless due to multi-line matches. I set up this alias to make it a bit less verb…
Don't you have to shift the arguments, so that `$1` does not also end in `filez`?
There is a `shift` in the function