semgrep v1.25 releases: Fast and syntax-aware semantic code pattern search
Semgrep
Semgrep is a command-line tool for offline static analysis. Use pre-built or custom rules to enforce code and security standards in your codebase. You can try it now with our interactive live editor.
Semgrep combines the convenient and iterative style of grep with the powerful features of an Abstract Syntax Tree (AST) matcher and limited dataflow. Easily find function calls, class or method definitions, and more without having to understand ASTs or wrestle with regexes.
Motivation
Semgrep exists because:
- Insecure code is easy to write
- The future of security involves automatically guiding developers towards a “paved road” made of default-safe frameworks (i.e. React or Object-relational Mappers)
- grep isn’t expressive enough and traditional static analysis tools (SAST) are too complicated/slow for paved road automation
The AppSec, Developer, and DevOps communities deserve a static analysis tool that is fast, easy to use, code-aware, multi-lingual and open source!
Overview
Semgrep is optimized for:
- Speed: Fast enough to run on every build, commit, or file save
- Finding bugs that matter: Run your own specialized rules or choose OWASP 10 checks from the Semgrep Registry. Rules match source code at the Abstract Syntax Tree (AST) level, unlike regexes that match strings and aren’t semantically aware.
- Ease of customization: Rules look like the code you’re searching for, no static analysis Ph.D. required. They don’t require compiled code, only source, reducing iteration time.
- Ease of integration. Highly portable and many CI and git-hook integrations already exist. Output –json and pipe results into your existing systems.
- Polyglot environments: Don’t learn and maintain multiple tools for your polyglot environment (e.g. ESLint, find-sec-bugs, RuboCop, Gosec). Use the same syntax and concepts independent of language.
Language Support
Go · Java · JavaScript · JSX · JSON · Python · Ruby · TypeScript · TSX
Pattern Syntax Teaser
One of the most unique and useful things about Semgrep is how easy it is to write and iterate on queries.
The goal is to make it as easy as possible to go from an idea in your head to find the code patterns you intend to.
Example: Say you want to find all calls to a function named exec, and you don’t care about the arguments. With Semgrep, you could simply supply the pattern exec(…) and you’d match:
Use case | Semgrep rule |
---|---|
Ban dangerous APIs | Prevent use of exec |
Search routes and authentication | Extract Spring routes |
Enforce the use secure defaults | Securely set Flask cookies |
Tainted data flowing into sinks | ExpressJS dataflow into sandbox.run |
Enforce project best-practices | Use assertEqual for == checks, Always check subprocess calls |
Codify project-specific knowledge | Verify transactions before making them |
Audit security hotspots | Finding XSS in Apache Airflow, Hardcoded credentials |
Audit configuration files | Find S3 ARN uses |
Migrate from deprecated APIs | DES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs |
Apply automatic fixes | Use listenAndServeTLS |
Changelog v1.25
Added
- aliengrep: new option ‘generic_caseless’ to achieve case-insensitive matching (gh-7883)
- Semgrep now includes heuristics based on the Java standard library and common naming patterns. These allow Semgrep to determine the types of more expressions in Java, for use with typed metavariables (https://semgrep.dev/docs/writing-rules/pattern-syntax/#typed-metavariables). (heuristics)
- Language server now supports search (and replace) with semgrep patterns through semgrep/search (ls-search)
- Language Server will now notify users of errors, and reason for crash (pa-2791)
Fixed
- Pro (taint analysis): Check function calls without parameters or parenthesis in Ruby (gh-7787)
- Aliengrep: ellipsis patterns that would be useless because of being placed
at the extremity of a pattern (always) or a line (in single-mode) are now
anchored to the beginning/end of input/line. For example,...
in multiline
mode matches the whole input rather than matching nothing many times. (gh-7881) - Fixed bug in constant propagation that made Semgrep fail to compute the value of
an integer constant when this was obtained via the multiplication of two other
constants. (gh-7893) - Fix regexps potentially vulnerable to ReDoS attacks in Python code for parsing
git URLs. Sets maximum length of git URLs to 1024 characters since parsing is
still perceptibly slow on 5000-byte input. Reported by Sebastian Chnelik,
PyUp.io. (gh-7943)
Install & Use
Copyright (C) 2020 returntocorp