SAST yourcode (in CLI, webapp and VSCode) w/ grep ... Semgrep [en,yt,zoom]
About
Bence and probably Yoann himself will discuss a program analysis tool they’re developing called Semgrep. It's a multilingual semantic tool for writing security and correctness queries on source code (for TS, TS/React, Python, Java, Go, C, and JS) with a simple “grep-like” interface. The original author, Yoann Padioleau, worked on Semgrep’s predecessor, Coccinelle, for Linux kernel refactoring, and later developed Semgrep while at Facebook. He’s now full time with us at r2c.
Semgrep is a free open-source program analysis toolkit that finds bugs. Semgrep is ideal for security researchers, product security engineers, and developers who want to find complex code patterns without extensive knowledge of ASTs or advanced program analysis concepts.
For example, find subprocess calls with shell=True in Python using the query:
subprocess.open(..., shell=True)
This will even find snippets like:
import subprocess as s
s.open(f'rm {args}', shell=True)
Or find hardcoded credentials using the query:
boto3.client(..., aws_secret_access_key=”...”, aws_access_key_id=”...” )
Duration: 45' talk/workshop + QA + chatting
Language: EN
###Moderated by
Péter Nyilasy on behalf of OWASP HU
Speakers
Bence Nagy is a software engineer at r2c, working on Semgrep, an open-source syntax-aware code search tool. At r2c, his responsibilities tend towards building various interfaces atop the core semgrep CLI. These include CI integrations, editor extensions, and the semgrep.live web app. He previously led a developer experience team at Kiwi.com, the Czech Republic’s top startup at the time of its acquisition in 2019. You should totally ask him for video game recommendations after the talk.
Yoann Padioleau is a software engineer at r2c, and the main author of Semgrep, an open-source syntax-aware code search tool. Previously, Yoann started the AppSec, Test Engineering, and Program Analysis teams at Facebook, where he created many tools for software developers, including an ancestor of Semgrep for PHP. Before that, he was doing research in academia with a focus on developer tools. He co-created Coccinelle in 2008 with Julia Lawall, which is also an ancestor of Semgrep for C. Yoann received his PhD in Computer Science at INRIA Rennes in France. He currently lives in Italy, and loves to code and do research on stuff which makes it easier to code stuff.
Source code: https://github.com/returntocorp/semgrep
Test in your browser: https://semgrep.live/