semgrep-rules

This is an repository containing rules written for semgrep, organized by language. Go to the main semgrep documentation for details on semgrep and the syntax for the yaml files in this repository.

Contributing

branch	using semgrep docker image	test status
`master`	`returntocorp/semgrep:latest`
`develop`	`returntocorp/semgrep:develop`

We welcome contributions to this repo! Please fork and make a pull request; we'll contact you about signing our CLA.

Running Rules in CI/Pre-Commit/Developer Workflow

If you want run these rules rather than write them, check out the easy-to-use bento.dev

Help

Join slack for the fastest answers to your questions! Or contact the team at semgrep@r2c.dev.

Testing Rules

A testing system is available which can be used to check the rules against example source code files. It requires semgrep from semgrep

If you wrote a rule in a yaml named eqeq-bad.yaml with a rule id named my-eqeq-bad, you could put a file in the same directory named eqeq-bad.py (it just needs to have the same name except for the extension as eqeq-bad.yaml). Then:

# ruleid:my-eqeq-bad
x == x

Running make test will execute the test suite, and if my-eqeq-bad does not fire on the line below the comment, your rule will fail.

If you have a rule that is not working, but you want to commit it soo it's documented but not fail the tests, use #todoruleid:...:

# todoruleid:my-eqeq-bad
x != x

Github Action To Run Tests

If you fork this repo or create your own, you can add a special semgrep-rules-test Github Action to your workflow that will automatically test your rules by running make test using the latest version of semgrep.