TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Semgrep: Semantic grep for code

415 点作者 ievans大约 4 年前

31 条评论

hyper_reality大约 4 年前
This is an excellent tool to have as a security consultant, and it just keeps getting better and better. When approaching a large codebase, it enables you to write custom rules that match on certain antipatterns you&#x27;ve spotted that may be unique to the codebase. That&#x27;s the real value of the tool, but the repository of per-language rules is also convenient for quickly finding low-hanging fruit (like every use of a potentially injectable function such as exec,system,etc. in PHP).<p>For example, a webapp may have been designed such that authorisation needs to be explicitly added with a line or two to each controller. A semgrep rule can be written to match all the controllers which are missing this line. Then these controllers can be manually reviewed to assess whether unauthorised access should be allowed. Depending on what you are trying to match, this is something that may be very complex or even impossible to implement accurately in plain grep. Some languages like Ruby have powerful static analysis tools (Brakeman) that can also do this, but the benefit of Semgrep is the flexibility across multiple languages and how readable the rulesets are. [1]<p>[1] <a href="https:&#x2F;&#x2F;blog.includesecurity.com&#x2F;2021&#x2F;01&#x2F;custom-static-analysis-rules-showdown-brakeman-vs-semgrep&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.includesecurity.com&#x2F;2021&#x2F;01&#x2F;custom-static-analy...</a>
评论 #26906725 未加载
评论 #26906503 未加载
评论 #26906534 未加载
评论 #26918660 未加载
评论 #26906119 未加载
thesuperbigfrog大约 4 年前
The name &quot;Semantic Grep&quot; does not give a good idea for what this tool is and what it does.<p>The web page states: &quot;Static analysis at ludicrous speed. Find bugs and enforce code standards&quot;<p>&quot;grep&quot; is short for &quot;global regular expression print&quot;. It finds matches for the given regular expression and prints them.<p>&quot;Semantic Grep&quot; is a static analyzer with configurable rules, style checks, etc. It does much more than search and print.<p>Perhaps a better name is needed?<p>Edit: How about &quot;omnilint&quot; or &quot;omnicritic&quot; since semgrep is more of a &quot;lint&quot; (<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Lint_(software)" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Lint_(software)</a>) or &quot;critic&quot; (<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Perl::Critic" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Perl::Critic</a>) type of tool that handles multiple languages?<p>Edit2: &quot;Static analysis at ludicrous speed&quot; ==&gt; &quot;turbolint&quot;? (&quot;ludicrous speed&quot; reminds of the hilarious Space Balls scene :) &quot;turbolint, GO!&quot;
评论 #26906896 未加载
评论 #26909408 未加载
评论 #26906127 未加载
评论 #26906260 未加载
评论 #26906308 未加载
westurner大约 4 年前
Is there a more complete example of how to call semgrep from pre-commit (which gets called before every git commit) in order to prevent e.g. Python print calls (print(), print \\n(), etc.) from being checked in?<p><a href="https:&#x2F;&#x2F;semgrep.dev&#x2F;docs&#x2F;extensions&#x2F;" rel="nofollow">https:&#x2F;&#x2F;semgrep.dev&#x2F;docs&#x2F;extensions&#x2F;</a> describes how to do pre-commit.<p>Nvm, here&#x27;s semgrep&#x27;s own .pre-commit-config.yml for semgrep itself: <a href="https:&#x2F;&#x2F;github.com&#x2F;returntocorp&#x2F;semgrep&#x2F;blob&#x2F;develop&#x2F;.pre-commit-config.yaml" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;returntocorp&#x2F;semgrep&#x2F;blob&#x2F;develop&#x2F;.pre-co...</a>
评论 #26908362 未加载
评论 #26909757 未加载
SavantIdiot大约 4 年前
Since the capability has never existed, I don&#x27;t think in terms of being able to semgrep. If that makes any sense. My brain is not wired this way, yet.<p>Like, if you&#x27;ve never tasted lychee, it would never occur to you how to cook with it.<p>I&#x27;m going to need to see some useful, real-world examples to jumpstart my brain to think this way.
评论 #26905738 未加载
评论 #26907763 未加载
joshuamorton大约 4 年前
There&#x27;s lots of confusion about what semgrep does here, which is kind of unfortunate. I haven&#x27;t touched it much, but I have built a very similar tool (I&#x27;m one of the contributors to refex[1], which is a <i>very</i> similar project).<p>The starting point of semantic grep is very useful. When you have a big codebase, you often want to detect antipatterns, or not even antipatterns, but just <i>uses</i> of a thing, say you&#x27;re renaming a method and want to track down the callers.<p>Being able to act on the AST, instead of hoping you searched up all of the variants of whitespace and line breaks and, depending on the specific example, different uses of argument passing, is really useful.<p>But often when you&#x27;re semantically grepping, your goal is to replace something with something else (this is what refex was initially built for: to aide in large scale changes in python, as a sort of equivalent to the C++ tools that Google uses).<p>But then you want to shift left even further: once you have a pattern that you want to replace once, you can just enforce that a linter yell at you when anyone does it again. So it&#x27;s very natural to develop a linter-style thing on top of one of these[2].<p>This is, as I understand it sort of the same thing that happens in C++: clang-tidy and clang-format are written on top of AST libraries that can be used for ad-hoc analysis and transformations, but you can also just plug them into a linter.<p>The thing is, for most organizations, enforcing code style and best practices is more valuable than apply a refactoring to 10M lines of code, because most organizations don&#x27;t have 10M lines of code to refactor. That doesn&#x27;t mean that these tools aren&#x27;t also useful for ad-hoc transforms and exploratory analysis. They absolutely are!<p>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;ssbr&#x2F;refex" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ssbr&#x2F;refex</a><p>[2]: <a href="https:&#x2F;&#x2F;github.com&#x2F;ssbr&#x2F;refex&#x2F;tree&#x2F;main&#x2F;refex&#x2F;fix" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ssbr&#x2F;refex&#x2F;tree&#x2F;main&#x2F;refex&#x2F;fix</a>
enriquto大约 4 年前
&gt; You need to enable JavaScript to run this app.<p>Wait, is this a web app? I was expecting a command line tool to navigate my code locally.
评论 #26905366 未加载
评论 #26905360 未加载
评论 #26905388 未加载
unwind大约 4 年前
When tools like this use terms like &quot;legacy languages&quot;, and don&#x27;t show that C is supported unless you click &quot;More Languages&quot;, it makes me feel old. :)<p>Still, it seems rather cool, I like the idea of being able to search code at a higher level than just raw source text.
kesterallen大约 4 年前
Typo in the &quot;Trying Semgrep&quot; screenshot (&quot;ruleste&quot;): <a href="https:&#x2F;&#x2F;semgrep.dev&#x2F;static&#x2F;media&#x2F;Step1.df848497.png" rel="nofollow">https:&#x2F;&#x2F;semgrep.dev&#x2F;static&#x2F;media&#x2F;Step1.df848497.png</a>
jhgb大约 4 年前
Isn&#x27;t &quot;grep for code&quot; called just &quot;grep&quot;?
评论 #26905441 未加载
评论 #26905348 未加载
leafmeal大约 4 年前
What does this give you over writing a flake8 plugin (for Python at least)?<p>I&#x27;ve found the flake8 API and documentation lacking, so perhaps just a cleaner interface?
rmetzler大约 4 年前
Looks like a useful tool for me and I would like to try it.<p>Go down, see &quot;brew install semgrep&quot; and try to copy paste it. And it&#x27;s an image :(
评论 #26911490 未加载
hn_throwaway_99大约 4 年前
I currently use a highly opinionated ESLint config (based on the airbnb one) together with strict checking in my TypeScript config, and it is configured to run on every commit with husky git hooks. The example given on the Semgrep homepage is an exact match to one that exists in my ESLint config (eslint&#x27;s no-console rule).<p>How does Semgrep compare to ESLint+a strict tsconfig?
评论 #26908162 未加载
评论 #26907478 未加载
shuringai大约 4 年前
This is much better alternative to codeQL used by google and does not use a shameless registration-only model! Thanks for sharing
评论 #26908763 未加载
vlovich123大约 4 年前
I want the ease of use of their AST specification with the power of clang’s refactor tool. Has anyone attempted to do that?
pabs3大约 4 年前
Does it come with a standard set of rules that finds bad code without any false positives out of the box? Or is it more of a tool for people doing code security audits &amp; pentesting who know what they are looking for and want to read the surrounding code?
layer8大约 4 年前
No Windows support yet: <a href="https:&#x2F;&#x2F;github.com&#x2F;returntocorp&#x2F;semgrep&#x2F;issues&#x2F;1330" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;returntocorp&#x2F;semgrep&#x2F;issues&#x2F;1330</a>
评论 #26906379 未加载
评论 #26906411 未加载
CGamesPlay大约 4 年前
How much does the CI service cost? I can&#x27;t seem to find any information about it on the website without creating an account.
评论 #26909779 未加载
nojvek大约 4 年前
The underlying package tree-sitter that semgrep uses is pretty amazing too. It’s an incremental parser for many different languages written in C.<p>It blows my mind how fast it is compared to many tools in js ecosystem. Tree-sitter was parsing millions of files in half a minute. JS, TS, Ruby, yaml, html, Css. It’s quite magical. Such great engineering.
vindarel大约 4 年前
Interesting. Looks similar to Comby: <a href="https:&#x2F;&#x2F;comby.dev&#x2F;" rel="nofollow">https:&#x2F;&#x2F;comby.dev&#x2F;</a> &quot;a tool for searching and changing code structure&quot;. Comby is more on rewriting, it has less integration for a CI (though you can do it), it is less geared towards reporting.
wdb大约 4 年前
Apparently this is invalid TypeScript (cannot parse it says):<p><pre><code> try { const parsedURL = new URL(url) requestPath = parsedURL.pathname } catch (error: unknown) { &#x2F;&#x2F; NOOP } </code></pre> It&#x27;s complaining about : unknown bit which one of the newer typescript eslint rules enforces.
评论 #26909879 未加载
realquadrant大约 4 年前
Hi, this is very cool. I have been building up a suite of tools to roll out across major open source projects to improve security. I like what I have seen so far, this is a great use case. Whom can I connect with to learn more? And similarity&#x2F;diff with sourcegraph, also like a lot.
silasb大约 4 年前
Just the tool that I was looking for. We are looking to do Service linting in our organization as a method of making sure our services don&#x27;t drift too far apart.<p>Anyone else know of a Service linting tool? OPA&#x2F;conftest come close but lack syntax parsers for Ruby&#x2F;Javascript.
more_corn大约 4 年前
I used to use SAST-SCAN but that seems abandonware. I like that this exists. Everyone should go from nothing to something in the SAST space. A free&#x2F;freemium tool&#x2F;service for that is pretty great. The first couple runs have found useful results.
afro88大约 4 年前
No swift support yet. What would be involved in adding it?
评论 #26910387 未加载
minusf大约 4 年前
probably doing something wrong but running the ci ruleset on a tiny django hobby project made all cores spin at 100% after 33% of the progress bar and made the OS almost unresponsive. ctrl-c after 5 minutes and i still had to pkill every semgrep process... never seen the M1 airbook overheat this much before.
评论 #26910191 未加载
sriram_malhar大约 4 年前
Nice looking tool.<p>Is there a way to search for functions in C (other than printf!) whose return value is ignored at the call site?
pantuza大约 4 年前
Really outstanding those guardrails rules from semgrep. Useful to enforce code. Thanks for sharing the tool.
globular-toast大约 4 年前
Whenever I see &quot;at ludicrous speed&quot; or something to that effect, I now assume it&#x27;s slow.
Annatar大约 4 年前
I click on the link above and I get a seemingly blank page, all because the website uses some JavaScript garbage and violates W3C standards. That&#x27;s the ridiculous, disgusting state of the information technology industry in the 21st century. I rue the day I decided to do this professionally, and I am deeply ashamed and despondent.
hardon4semgrep大约 4 年前
How does this compare to the tools available at large companies like Google and Facebook?
solipsism大约 4 年前
What&#x27;s the status of C++ support?
评论 #26911802 未加载