by ievans on 4/22/21, 4:51 PM with 104 comments
by hyper_reality on 4/22/21, 6:06 PM
For example, a webapp may have been designed such that authorisation needs to be explicitly added with a line or two to each controller. A semgrep rule can be written to match all the controllers which are missing this line. Then these controllers can be manually reviewed to assess whether unauthorised access should be allowed. Depending on what you are trying to match, this is something that may be very complex or even impossible to implement accurately in plain grep. Some languages like Ruby have powerful static analysis tools (Brakeman) that can also do this, but the benefit of Semgrep is the flexibility across multiple languages and how readable the rulesets are. [1]
[1] https://blog.includesecurity.com/2021/01/custom-static-analy...
by thesuperbigfrog on 4/22/21, 6:16 PM
The web page states: "Static analysis at ludicrous speed. Find bugs and enforce code standards"
"grep" is short for "global regular expression print". It finds matches for the given regular expression and prints them.
"Semantic Grep" is a static analyzer with configurable rules, style checks, etc. It does much more than search and print.
Perhaps a better name is needed?
Edit: How about "omnilint" or "omnicritic" since semgrep is more of a "lint" (https://en.wikipedia.org/wiki/Lint_(software)) or "critic" (https://en.wikipedia.org/wiki/Perl::Critic) type of tool that handles multiple languages?
Edit2: "Static analysis at ludicrous speed" ==> "turbolint"? ("ludicrous speed" reminds of the hilarious Space Balls scene :) "turbolint, GO!"
by westurner on 4/22/21, 6:17 PM
https://semgrep.dev/docs/extensions/ describes how to do pre-commit.
Nvm, here's semgrep's own .pre-commit-config.yml for semgrep itself: https://github.com/returntocorp/semgrep/blob/develop/.pre-co...
by SavantIdiot on 4/22/21, 5:42 PM
Like, if you've never tasted lychee, it would never occur to you how to cook with it.
I'm going to need to see some useful, real-world examples to jumpstart my brain to think this way.
by joshuamorton on 4/23/21, 12:24 AM
The starting point of semantic grep is very useful. When you have a big codebase, you often want to detect antipatterns, or not even antipatterns, but just uses of a thing, say you're renaming a method and want to track down the callers.
Being able to act on the AST, instead of hoping you searched up all of the variants of whitespace and line breaks and, depending on the specific example, different uses of argument passing, is really useful.
But often when you're semantically grepping, your goal is to replace something with something else (this is what refex was initially built for: to aide in large scale changes in python, as a sort of equivalent to the C++ tools that Google uses).
But then you want to shift left even further: once you have a pattern that you want to replace once, you can just enforce that a linter yell at you when anyone does it again. So it's very natural to develop a linter-style thing on top of one of these[2].
This is, as I understand it sort of the same thing that happens in C++: clang-tidy and clang-format are written on top of AST libraries that can be used for ad-hoc analysis and transformations, but you can also just plug them into a linter.
The thing is, for most organizations, enforcing code style and best practices is more valuable than apply a refactoring to 10M lines of code, because most organizations don't have 10M lines of code to refactor. That doesn't mean that these tools aren't also useful for ad-hoc transforms and exploratory analysis. They absolutely are!
by enriquto on 4/22/21, 5:24 PM
Wait, is this a web app? I was expecting a command line tool to navigate my code locally.
by unwind on 4/22/21, 6:45 PM
Still, it seems rather cool, I like the idea of being able to search code at a higher level than just raw source text.
by kesterallen on 4/22/21, 6:04 PM
by jhgb on 4/22/21, 5:21 PM
by leafmeal on 4/22/21, 8:52 PM
I've found the flake8 API and documentation lacking, so perhaps just a cleaner interface?
by rmetzler on 4/22/21, 6:17 PM
Go down, see "brew install semgrep" and try to copy paste it. And it's an image :(
by hn_throwaway_99 on 4/22/21, 6:40 PM
How does Semgrep compare to ESLint+a strict tsconfig?
by shuringai on 4/22/21, 10:05 PM
by vlovich123 on 4/22/21, 7:50 PM
by pabs3 on 4/22/21, 10:31 PM
by layer8 on 4/22/21, 6:18 PM
by CGamesPlay on 4/22/21, 11:33 PM
by nojvek on 4/23/21, 6:50 AM
It blows my mind how fast it is compared to many tools in js ecosystem. Tree-sitter was parsing millions of files in half a minute. JS, TS, Ruby, yaml, html, Css. It’s quite magical. Such great engineering.
by vindarel on 4/23/21, 8:11 AM
by wdb on 4/22/21, 11:10 PM
try {
const parsedURL = new URL(url)
requestPath = parsedURL.pathname
} catch (error: unknown) {
// NOOP
}
by realquadrant on 4/22/21, 10:38 PM
by silasb on 4/22/21, 6:19 PM
Anyone else know of a Service linting tool? OPA/conftest come close but lack syntax parsers for Ruby/Javascript.
by more_corn on 4/22/21, 8:11 PM
by afro88 on 4/22/21, 7:46 PM
by minusf on 4/22/21, 10:50 PM
by sriram_malhar on 4/23/21, 9:31 AM
Is there a way to search for functions in C (other than printf!) whose return value is ignored at the call site?
by pantuza on 4/22/21, 8:59 PM
by globular-toast on 4/23/21, 8:05 AM
by Annatar on 4/23/21, 6:27 AM
by hardon4semgrep on 4/23/21, 8:15 AM
by solipsism on 4/23/21, 5:30 AM