Semgrep: static analysis with rules you can read

Semgrep (about 17,000 stars on GitHub) is a static analysis engine whose distinctive feature is the rule syntax: a pattern is written in the target language itself, with placeholders such as $X for any expression and ... for any sequence of statements. The engine grew out of sgrep, a tool Yoann Padioleau wrote at Facebook around 2009, and was revived in 2019 by the company now called Semgrep, Inc. (previously r2c), which maintains the open source engine alongside a commercial platform. The name is short for semantic grep.

What it finds

Semgrep parses source files into syntax trees and matches rules against them, so a rule for subprocess.call($CMD, shell=True) finds that call however it is formatted and whichever variable is passed. Rules in the public registry cover security weaknesses from the OWASP Top 10 (injection, hard-coded credentials, weak cryptography, unsafe deserialisation), framework-specific mistakes, and ordinary correctness and style issues. Rulesets exist for Python, JavaScript and TypeScript, Go, Java, C#, PHP, Ruby, Rust, Kotlin, Scala, Bash and many others, and teams write their own rules in YAML to enforce project conventions. The open source engine performs intra-file analysis; cross-file dataflow belongs to the commercial product.

Who it is for

• Developers who want security linting on their own code with results they can understand, because each rule links to its pattern and an explanation.
• Teams that add a static analysis step to CI; the how-to Scan your own code and containers in CI: Gitleaks, Semgrep and Trivy shows one.
• Reviewers who want to encode a recurring review comment as a rule so it is caught automatically next time.
• Security engineers writing custom rules for an internal framework or a known vulnerable API.

How to install and try it

pipx install semgrep
semgrep --version
semgrep scan --config auto .

The --config auto option picks registry rulesets that match the languages found in the current directory and prints a list of findings with file, line and rule identifier. Specific rulesets such as p/owasp-top-ten or a local YAML file can be passed instead. Homebrew and a Docker image are the other common install routes; Windows users run it through WSL or the container. The documentation explains the rule syntax and the playground where rules can be tested in a browser.

Credit

Semgrep is developed by Semgrep, Inc. and a community of contributors, building on Yoann Padioleau’s original sgrep. The engine is published under the GNU LGPL 2.1; rules in the community registry carry their own licences, most of them permissive.