Useful Semgrep Links
Opened this issue · 0 comments
github-learning-lab commented
This issue collects various links to useful Semgrep resources and documentation in one place so you can reference it if you ever get stuck.
- semgrep.dev - Semgrep's home page
- @returntocorp/semgrep - Semgrep's source code on GitHub
- Semgrep Registry - Home of Semgrep's free, out-of-the-box rules (that is, security checks), written by r2c and the community.
- These rules are grouped into "rulesets" that collect related functionality, like rules that check for secrets, target specific languages (e.g. javascript) or frameworks (e.g. django), or even entire vulnerability classes (e.g. xss or insecure
transport). - @returntocorp/semgrep-rules - The source code of Semgrep's rules on GitHub.
- Note that the Registry has more rules than what's just in the
returntocorp/semgrep-rules
repo, as the Registry includes Semgrep rules from other community repos, like NodeJSScan or Go rules by Damian Gryski.
- Note that the Registry has more rules than what's just in the
- These rules are grouped into "rulesets" that collect related functionality, like rules that check for secrets, target specific languages (e.g. javascript) or frameworks (e.g. django), or even entire vulnerability classes (e.g. xss or insecure
- Semgrep Playground - Write and share Semgrep rules right from your browser, no installation required!
Rule Writing
There's a step by step rule writing tutorial here.
If you go to the Playground, you can also click the "Examples" button to view a number of illustrative built-in examples.
And of course, you can also review the over 1,000 rules in @returntocorp/semgrep-rules.
Docs
Semgrep has pretty extensive docs, which you can view here.
Of note:
- Pattern syntax - All of the ways you can match code within one pattern.
- Rule syntax - All of the ways you can combine Semgrep patterns to form more complex queries. For example, looking for code that matches
this
ANDthat
, orthis
but NOTthat
, etc.
Community
Feel free to join the r2c community Slack to ask questions (we're super responsive!) or reach out to us on Twitter (@r2cdev), or send us an email at support@r2c.dev.