| Name | semgrep JSON |
| Version |
1.69.0
JSON |
| download |
| home_page | https://github.com/returntocorp/semgrep |
| Summary | Lightweight static analysis for many languages. Find bug variants with patterns that look like source code. |
| upload_time | 2024-04-16 01:59:53 |
| maintainer | None |
| docs_url | None |
| author | Semgrep Inc. |
| requires_python | >=3.8 |
| license | None |
| keywords |
|
| VCS |
 |
| bugtrack_url |
|
| requirements |
No requirements were recorded.
|
| Travis-CI |
No Travis.
|
| coveralls test coverage |
No coveralls.
|
<br />
<p align="center">
<a href="https://semgrep.dev">
<picture>
<source media="(prefers-color-scheme: light)" srcset="images/semgrep-logo-light.svg">
<source media="(prefers-color-scheme: dark)" srcset="images/semgrep-logo-dark.svg">
<img src="https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-logo-light.svg" height="100" alt="Semgrep logo"/>
</picture>
</a>
</p>
<h2 align="center">
Code scanning at ludicrous speed.
</h2>
<p align="center">
<a href="https://formulae.brew.sh/formula/semgrep">
<img src="https://img.shields.io/homebrew/v/semgrep?style=flat-square" alt="Homebrew" />
</a>
<a href="https://pypi.org/project/semgrep/">
<img alt="PyPI" src="https://img.shields.io/pypi/v/semgrep?style=flat-square&color=blue">
</a>
<a href="https://semgrep.dev/docs/">
<img src="https://img.shields.io/badge/docs-semgrep.dev-purple?style=flat-square" alt="Documentation" />
</a>
<a href="https://go.semgrep.dev/slack">
<img src="https://img.shields.io/badge/slack-3.5k%20members-green?style=flat-square" alt="Join Semgrep community Slack" />
</a>
<a href="https://github.com/semgrep/semgrep/issues/new/choose">
<img src="https://img.shields.io/badge/issues-welcome-green?style=flat-square" alt="Issues welcome!" />
</a>
<a href="https://github.com/semgrep/semgrep#readme">
<img src="https://img.shields.io/github/stars/semgrep/semgrep?label=GitHub%20Stars&style=flat-square" alt="Star Semgrep on GitHub" />
</a>
<a href="https://hub.docker.com/r/semgrep/semgrep">
<img src="https://img.shields.io/docker/pulls/semgrep/semgrep.svg?style=flat-square" alt="Docker Pulls" />
</a>
<a href="https://hub.docker.com/r/returntocorp/semgrep">
<img src="https://img.shields.io/docker/pulls/returntocorp/semgrep.svg?style=flat-square" alt="Docker Pulls (Old)" />
</a>
<a href="https://twitter.com/intent/follow?screen_name=semgrep">
<img src="https://img.shields.io/twitter/follow/semgrep?label=Follow%20semgrep&style=social&color=blue" alt="Follow @semgrep on Twitter" />
</a>
</p>
</br>
This repository contains the source code for Semgrep OSS (open-source software). Semgrep OSS is a fast, open-source, static analysis tool for searching code, finding bugs, and enforcing code standards at editor, commit, and CI time. Semgrep is a semantic grep for code: where `grep "2"` would only match the exact string _2_, Semgrep would [match `x = 1; y = x + 1` when searching for _2_](https://semgrep.dev/playground/s/5rKgj). And it does this in 30+ languages! Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs: read more below.
For companies who need SAST, SCA, and Secret scanning, we provide a product suite on top of Semgrep OSS that scans code and package dependencies for known issues, software vulnerabilities, and finds secrets with high accuracy:
- [**Semgrep Code**](https://semgrep.dev/products/semgrep-code/) to find bugs & vulnerabilities using the deeper, interfile-analysis enabled [Pro engine](https://semgrep.dev/products/pro-engine/) and high-accuracy Pro rules in addition to the community rules
- [**Semgrep Supply Chain**](https://semgrep.dev/products/semgrep-supply-chain/) to find dependencies with known vulnerabilities function-level reachability analysis
- [**Semgrep Secrets**](https://semgrep.dev/products/semgrep-secrets/) to find hard-coded credentials that shouldn't be checked into source code
Semgrep analyzes code locally on your computer or in your build environment: **by default, code is never uploaded**. [Get started →.](#getting-started-)
<a href="#option-1-getting-started-from-the-cli">
<img src="https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-scan-cli.jpg" alt="Semgrep CLI image"/></a>
### Language support
**Semgrep Code** supports 30+ languages, including:
Apex · Bash · C · C++ · C# · Clojure · Dart · Dockerfile · Elixir · HTML · Go · Java · JavaScript · JSX · JSON · Julia · Jsonnet · Kotlin · Lisp · Lua · OCaml · PHP · Python · R · Ruby · Rust · Scala · Scheme · Solidity · Swift · Terraform · TypeScript · TSX · YAML · XML · Generic (ERB, Jinja, etc.)
**Semgrep Supply Chain** supports 12 languages across 15 package managers, including:
C# (NuGet) · Dart (Pub) · Go (Go modules, `go mod`) · Java (Gradle, Maven) · Javascript/Typescript (npm, Yarn, Yarn 2, Yarn 3, pnpm) · Kotlin (Gradle, Maven) · PHP (Composer) · Python (pip, pip-tool, Pipenv, Poetry) · Ruby (RubyGems) · Rust (Cargo) · Scala (Maven) · Swift (SwiftPM)
For more information, see [Supported languages](https://semgrep.dev/docs/supported-languages/).
### Getting started 🚀
1. [From the Semgrep Cloud Platform](#option-1-getting-started-from-the-semgrep-cloud-platform-recommended)
2. [From the CLI](#option-2-getting-started-from-the-cli)
For new users, we recommend starting with the [Semgrep Cloud Platform](#option-1-getting-started-from-the-semgrep-cloud-platform-recommended) because it provides a visual interface, a demo project, result triaging and exploration workflows, and makes setup in CI/CD fast. Scans are still local and code isn't uploaded. Alternatively, you can also start with the CLI and navigate the terminal output to run one-off searches.
### Option 1: Getting started from the Semgrep Cloud Platform (Recommended)
<a href="https://go.semgrep.dev/login-ghrmgo" target="_blank"><img src="https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-main-image.jpg" alt="Semgrep platform image"/> </a>
1. Register on <a href="https://go.semgrep.dev/login-ghrmgo" target="_blank">semgrep.dev</a>
2. Explore the demo findings to learn how Semgrep works
3. Scan your project by navigating to `Projects > Scan New Project > Run scan in CI`
4. Select your version control system and follow the onboarding steps to add your project. After this setup, Semgrep will scan your project after every pull request.
5. [Optional] If you want to run Semgrep locally, follow the steps in the CLI section.
### Notes:
If there are any issues, <a href="https://go.semgrep.dev/slack" target="_blank">please ask for help in the Semgrep Slack</a>.
### Option 2: Getting started from the CLI
1. Install Semgrep CLI
```
# For macOS
$ brew install semgrep
# For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep
# To try Semgrep without installation run via Docker
$ docker run -it -v "${PWD}:/src" semgrep/semgrep semgrep login
$ docker run -e SEMGREP_APP_TOKEN=<TOKEN> --rm -v "${PWD}:/src" semgrep/semgrep semgrep ci
```
2. Run `semgrep login` to create your account and login to Semgrep.
Logging into Semgrep gets you access to:
- [Semgrep Supply Chain](https://semgrep.dev/products/semgrep-supply-chain): A dependency scanner that detects reachable vulnerabilities in third party libraries
- [Semgrep Code's Pro rules](https://semgrep.dev/products/semgrep-code): 600+ high confidence rules written by Semgrep's security research team
- [Semgrep Code's Pro engine](https://semgrep.dev/products/pro-engine/): An advanced code analysis engine, designed to detect complex vulnerabilities, and reduce false positives
3. Go to your app's root directory and run `semgrep ci`. This will scan your project to check for vulnerabilities in your source code and its dependencies.
4. Try writing your own query interactively with `-e`. For example, a check for Python == where the left and right hand sides are the same (potentially a bug):
`$ semgrep -e '$X == $X' --lang=py path/to/src`
### Semgrep Ecosystem
The Semgrep ecosystem includes the following products:
- [Semgrep Code](https://semgrep.dev/products/semgrep-code) - Scan your code with Semgrep's proprietary rules (written by our Security Research team) using our cross-file and cross-function analysis. Designed to find OWASP Top 10 vulnerabilities and protect against critical security risks. Semgrep Code is available on both [free and paid tiers](https://semgrep.dev/pricing).
- [Semgrep Supply Chain (SSC)](https://semgrep.dev/products/semgrep-supply-chain) - A high-signal dependency scanner that detects reachable vulnerabilities in open source third-party libraries and functions across the software development life cycle (SDLC). Semgrep Supply Chain is available on both [free and paid tiers](https://semgrep.dev/pricing).
- [Semgrep Secrets [NEW!]](https://semgrep.dev/blog/2023/introducing-semgrep-secrets/) - Secrets detection that uses semantic analysis, improved entropy analysis, and validation together to accurately detect sensitive credentials in developer workflows. [Book a demo](https://get.semgrep.dev/secrets-beta-request.html) to request early access to the product.
- [Semgrep Cloud Platform (SCP)](https://semgrep.dev/login) - Deploy, manage, and monitor Semgrep at scale, with [free and paid tiers](https://semgrep.dev/pricing). Integrates with continuous integration (CI) providers such as GitHub, GitLab, CircleCI, and more.
- [Semgrep OSS Engine](https://semgrep.dev/docs/cli-reference/) - The open-source engine and community-contributed rules at the heart of everything (this project).
To learn more about Semgrep, visit:
- [Semgrep Playground](https://semgrep.dev/editor) - An online interactive tool for writing and sharing rules.
- [Semgrep Registry](https://semgrep.dev/explore) - 2,000+ community-driven rules covering security, correctness, and dependency vulnerabilities.
Join hundreds of thousands of other developers and security engineers already using Semgrep at companies like GitLab, Dropbox, Slack, Figma, Shopify, HashiCorp, Snowflake, and Trail of Bits.
Semgrep is developed and commercially supported by [Semgrep, Inc., a software security company](https://semgrep.dev).
### Semgrep Rules
Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python `print()` statements.
Run it online in Semgrep’s Playground by [clicking here](https://semgrep.dev/s/ievans:print-to-logger).
<p align="center">
<a href="https://semgrep.dev/s/ievans:print-to-logger" target="_blank"><img src="https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-example-rules-editor.jpg" width="582" alt="Semgrep rule example for finding Python print() statements" /></a>
</p>
#### Examples
Visit [Docs > Rule examples](https://semgrep.dev/docs/writing-rules/rule-ideas/) for use cases and ideas.
| Use case | Semgrep rule |
| :-------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Ban dangerous APIs | [Prevent use of exec](https://semgrep.dev/playground/s/lglB) |
| Search routes and authentication | [Extract Spring routes](https://semgrep.dev/playground/s/Y6wD) |
| Enforce the use secure defaults | [Securely set Flask cookies](https://semgrep.dev/playground/s/6KwW) |
| Tainted data flowing into sinks | [ExpressJS dataflow into sandbox.run](https://semgrep.dev/playground/s/qEpR) |
| Enforce project best-practices | [Use assertEqual for == checks](https://semgrep.dev/playground/s/oEox), [Always check subprocess calls](https://semgrep.dev/playground/s/zENk) |
| Codify project-specific knowledge | [Verify transactions before making them](https://semgrep.dev/playground/s/p8zk) |
| Audit security hotspots | [Finding XSS in Apache Airflow](https://semgrep.dev/playground/s/KPwj), [Hardcoded credentials](https://semgrep.dev/playground/s/2Br8) |
| Audit configuration files | [Find S3 ARN uses](https://semgrep.dev/playground/s/jEKD) |
| Migrate from deprecated APIs | [DES is deprecated](https://semgrep.dev/playground/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated), [Deprecated Flask APIs](https://semgrep.dev/playground/r/python.flask.maintainability.deprecated.deprecated-apis.flask-deprecated-apis), [Deprecated Bokeh APIs](https://semgrep.dev/playground/r/python.bokeh.maintainability.deprecated.deprecated_apis.bokeh-deprecated-apis) |
| Apply automatic fixes | [Use listenAndServeTLS](https://semgrep.dev/playground/s/1Ayk) |
### Extensions
Visit [Docs > Extensions](https://semgrep.dev/docs/extensions/) to learn about using Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!
### Documentation
Browse the full Semgrep [documentation on the website](https://semgrep.dev/docs). If you’re new to Semgrep, check out [Docs > Getting started](https://semgrep.dev/docs/getting-started/) or the [interactive tutorial](https://semgrep.dev/learn).
### Metrics
Using remote configuration from the [Registry](https://semgrep.dev/r) (like `--config=p/ci`) reports pseudonymous rule metrics to semgrep.dev.
Using configs from local files (like `--config=xyz.yml`) does **not** enable metrics.
To disable Registry rule metrics, use `--metrics=off`.
The Semgrep [privacy policy](https://semgrep.dev/docs/metrics) describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.
### More
- [Frequently asked questions (FAQs)](https://semgrep.dev/docs/faq/)
- [Contributing](https://semgrep.dev/docs/contributing/contributing/)
- [Build instructions for developers](INSTALL.md)
- [Ask questions in the Semgrep community Slack](https://go.semgrep.dev/slack)
- [CLI reference and exit codes](https://semgrep.dev/docs/cli-usage)
- [Semgrep YouTube channel](https://www.youtube.com/c/semgrep)
- [License (LGPL-2.1)](LICENSE)
- [Licensing Semgrep](https://semgrep.dev/docs/licensing/)
### Upgrading
To upgrade, run the command below associated with how you installed Semgrep:
```sh
# Using Homebrew
$ brew upgrade semgrep
# Using pip
$ python3 -m pip install --upgrade semgrep
# Using Docker
$ docker pull semgrep/semgrep:latest
```
Raw data
{
"_id": null,
"home_page": "https://github.com/returntocorp/semgrep",
"name": "semgrep",
"maintainer": null,
"docs_url": null,
"requires_python": ">=3.8",
"maintainer_email": null,
"keywords": null,
"author": "Semgrep Inc.",
"author_email": "support@semgrep.com",
"download_url": "https://files.pythonhosted.org/packages/88/6d/09a15143a884dad5a8fe3e539d2ed084bc4d107a9d3ee4c7d6b2ba14ed0f/semgrep-1.69.0.tar.gz",
"platform": null,
"description": "<br />\n<p align=\"center\">\n <a href=\"https://semgrep.dev\">\n <picture>\n <source media=\"(prefers-color-scheme: light)\" srcset=\"images/semgrep-logo-light.svg\">\n <source media=\"(prefers-color-scheme: dark)\" srcset=\"images/semgrep-logo-dark.svg\">\n <img src=\"https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-logo-light.svg\" height=\"100\" alt=\"Semgrep logo\"/>\n </picture>\n </a>\n</p>\n<h2 align=\"center\">\n Code scanning at ludicrous speed.\n</h2>\n<p align=\"center\">\n <a href=\"https://formulae.brew.sh/formula/semgrep\">\n <img src=\"https://img.shields.io/homebrew/v/semgrep?style=flat-square\" alt=\"Homebrew\" />\n </a>\n <a href=\"https://pypi.org/project/semgrep/\">\n <img alt=\"PyPI\" src=\"https://img.shields.io/pypi/v/semgrep?style=flat-square&color=blue\">\n </a>\n <a href=\"https://semgrep.dev/docs/\">\n <img src=\"https://img.shields.io/badge/docs-semgrep.dev-purple?style=flat-square\" alt=\"Documentation\" />\n </a>\n <a href=\"https://go.semgrep.dev/slack\">\n <img src=\"https://img.shields.io/badge/slack-3.5k%20members-green?style=flat-square\" alt=\"Join Semgrep community Slack\" />\n </a>\n <a href=\"https://github.com/semgrep/semgrep/issues/new/choose\">\n <img src=\"https://img.shields.io/badge/issues-welcome-green?style=flat-square\" alt=\"Issues welcome!\" />\n </a>\n <a href=\"https://github.com/semgrep/semgrep#readme\">\n <img src=\"https://img.shields.io/github/stars/semgrep/semgrep?label=GitHub%20Stars&style=flat-square\" alt=\"Star Semgrep on GitHub\" />\n </a>\n <a href=\"https://hub.docker.com/r/semgrep/semgrep\">\n <img src=\"https://img.shields.io/docker/pulls/semgrep/semgrep.svg?style=flat-square\" alt=\"Docker Pulls\" />\n </a>\n <a href=\"https://hub.docker.com/r/returntocorp/semgrep\">\n <img src=\"https://img.shields.io/docker/pulls/returntocorp/semgrep.svg?style=flat-square\" alt=\"Docker Pulls (Old)\" />\n </a>\n <a href=\"https://twitter.com/intent/follow?screen_name=semgrep\">\n <img src=\"https://img.shields.io/twitter/follow/semgrep?label=Follow%20semgrep&style=social&color=blue\" alt=\"Follow @semgrep on Twitter\" />\n </a>\n</p>\n</br>\n\nThis repository contains the source code for Semgrep OSS (open-source software). Semgrep OSS is a fast, open-source, static analysis tool for searching code, finding bugs, and enforcing code standards at editor, commit, and CI time. Semgrep is a semantic grep for code: where `grep \"2\"` would only match the exact string _2_, Semgrep would [match `x = 1; y = x + 1` when searching for _2_](https://semgrep.dev/playground/s/5rKgj). And it does this in 30+ languages! Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs: read more below.\n\nFor companies who need SAST, SCA, and Secret scanning, we provide a product suite on top of Semgrep OSS that scans code and package dependencies for known issues, software vulnerabilities, and finds secrets with high accuracy:\n- [**Semgrep Code**](https://semgrep.dev/products/semgrep-code/) to find bugs & vulnerabilities using the deeper, interfile-analysis enabled [Pro engine](https://semgrep.dev/products/pro-engine/) and high-accuracy Pro rules in addition to the community rules\n- [**Semgrep Supply Chain**](https://semgrep.dev/products/semgrep-supply-chain/) to find dependencies with known vulnerabilities function-level reachability analysis\n- [**Semgrep Secrets**](https://semgrep.dev/products/semgrep-secrets/) to find hard-coded credentials that shouldn't be checked into source code\n\nSemgrep analyzes code locally on your computer or in your build environment: **by default, code is never uploaded**. [Get\u00a0started\u00a0\u2192.](#getting-started-)\n\n<a href=\"#option-1-getting-started-from-the-cli\">\n<img src=\"https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-scan-cli.jpg\" alt=\"Semgrep CLI image\"/></a>\n\n### Language support\n\n**Semgrep Code** supports 30+ languages, including:\n\nApex \u00b7 Bash \u00b7 C \u00b7 C++ \u00b7 C# \u00b7 Clojure \u00b7 Dart \u00b7 Dockerfile \u00b7 Elixir \u00b7 HTML \u00b7 Go \u00b7 Java \u00b7 JavaScript \u00b7 JSX \u00b7 JSON \u00b7 Julia \u00b7 Jsonnet \u00b7 Kotlin \u00b7 Lisp \u00b7 Lua \u00b7 OCaml \u00b7 PHP \u00b7 Python \u00b7 R \u00b7 Ruby \u00b7 Rust \u00b7 Scala \u00b7 Scheme \u00b7 Solidity \u00b7 Swift \u00b7 Terraform \u00b7 TypeScript \u00b7 TSX \u00b7 YAML \u00b7 XML \u00b7 Generic (ERB, Jinja, etc.)\n\n**Semgrep Supply Chain** supports 12 languages across 15 package managers, including:\n\nC# (NuGet) \u00b7 Dart (Pub) \u00b7 Go (Go modules, `go mod`) \u00b7 Java (Gradle, Maven) \u00b7 Javascript/Typescript (npm, Yarn, Yarn 2, Yarn 3, pnpm) \u00b7 Kotlin (Gradle, Maven) \u00b7 PHP (Composer) \u00b7 Python (pip, pip-tool, Pipenv, Poetry) \u00b7 Ruby (RubyGems) \u00b7 Rust (Cargo) \u00b7 Scala (Maven) \u00b7 Swift (SwiftPM)\n\nFor more information, see [Supported languages](https://semgrep.dev/docs/supported-languages/).\n\n### Getting started \ud83d\ude80\n\n1. [From the Semgrep Cloud Platform](#option-1-getting-started-from-the-semgrep-cloud-platform-recommended)\n2. [From the CLI](#option-2-getting-started-from-the-cli)\n\nFor new users, we recommend starting with the [Semgrep Cloud Platform](#option-1-getting-started-from-the-semgrep-cloud-platform-recommended) because it provides a visual interface, a demo project, result triaging and exploration workflows, and makes setup in CI/CD fast. Scans are still local and code isn't uploaded. Alternatively, you can also start with the CLI and navigate the terminal output to run one-off searches.\n\n### Option 1: Getting started from the Semgrep Cloud Platform (Recommended)\n\n<a href=\"https://go.semgrep.dev/login-ghrmgo\" target=\"_blank\"><img src=\"https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-main-image.jpg\" alt=\"Semgrep platform image\"/> </a>\n\n1. Register on <a href=\"https://go.semgrep.dev/login-ghrmgo\" target=\"_blank\">semgrep.dev</a>\n\n2. Explore the demo findings to learn how Semgrep works\n\n3. Scan your project by navigating to `Projects > Scan New Project > Run scan in CI`\n\n4. Select your version control system and follow the onboarding steps to add your project. After this setup, Semgrep will scan your project after every pull request.\n\n5. [Optional] If you want to run Semgrep locally, follow the steps in the CLI section.\n\n### Notes:\n\nIf there are any issues, <a href=\"https://go.semgrep.dev/slack\" target=\"_blank\">please ask for help in the Semgrep Slack</a>.\n\n### Option 2: Getting started from the CLI\n\n1. Install Semgrep CLI\n\n```\n# For macOS\n$ brew install semgrep\n\n# For Ubuntu/WSL/Linux/macOS\n$ python3 -m pip install semgrep\n\n# To try Semgrep without installation run via Docker\n$ docker run -it -v \"${PWD}:/src\" semgrep/semgrep semgrep login\n$ docker run -e SEMGREP_APP_TOKEN=<TOKEN> --rm -v \"${PWD}:/src\" semgrep/semgrep semgrep ci\n```\n\n2. Run `semgrep login` to create your account and login to Semgrep.\n\nLogging into Semgrep gets you access to:\n\n- [Semgrep Supply Chain](https://semgrep.dev/products/semgrep-supply-chain): A dependency scanner that detects reachable vulnerabilities in third party libraries\n- [Semgrep Code's Pro rules](https://semgrep.dev/products/semgrep-code): 600+ high confidence rules written by Semgrep's security research team\n- [Semgrep Code's Pro engine](https://semgrep.dev/products/pro-engine/): An advanced code analysis engine, designed to detect complex vulnerabilities, and reduce false positives\n\n3. Go to your app's root directory and run `semgrep ci`. This will scan your project to check for vulnerabilities in your source code and its dependencies.\n\n4. Try writing your own query interactively with `-e`. For example, a check for Python == where the left and right hand sides are the same (potentially a bug):\n`$ semgrep -e '$X == $X' --lang=py path/to/src`\n\n### Semgrep Ecosystem\n\nThe Semgrep ecosystem includes the following products:\n\n- [Semgrep Code](https://semgrep.dev/products/semgrep-code) - Scan your code with Semgrep's proprietary rules (written by our Security Research team) using our cross-file and cross-function analysis. Designed to find OWASP Top 10 vulnerabilities and protect against critical security risks. Semgrep Code is available on both [free and paid tiers](https://semgrep.dev/pricing).\n- [Semgrep Supply Chain (SSC)](https://semgrep.dev/products/semgrep-supply-chain) - A high-signal dependency scanner that detects reachable vulnerabilities in open source third-party libraries and functions across the software development life cycle (SDLC). Semgrep Supply Chain is available on both [free and paid tiers](https://semgrep.dev/pricing).\n- [Semgrep Secrets [NEW!]](https://semgrep.dev/blog/2023/introducing-semgrep-secrets/) - Secrets detection that uses semantic analysis, improved entropy analysis, and validation together to accurately detect sensitive credentials in developer workflows. [Book a demo](https://get.semgrep.dev/secrets-beta-request.html) to request early access to the product.\n- [Semgrep Cloud Platform (SCP)](https://semgrep.dev/login) - Deploy, manage, and monitor Semgrep at scale, with [free and paid tiers](https://semgrep.dev/pricing). Integrates with continuous integration (CI) providers such as GitHub, GitLab, CircleCI, and more.\n- [Semgrep OSS Engine](https://semgrep.dev/docs/cli-reference/) - The open-source engine and community-contributed rules at the heart of everything (this project).\n\nTo learn more about Semgrep, visit:\n\n- [Semgrep Playground](https://semgrep.dev/editor) - An online interactive tool for writing and sharing rules.\n- [Semgrep Registry](https://semgrep.dev/explore) - 2,000+ community-driven rules covering security, correctness, and dependency vulnerabilities.\n\nJoin hundreds of thousands of other developers and security engineers already using Semgrep at companies like GitLab, Dropbox, Slack, Figma, Shopify, HashiCorp, Snowflake, and Trail of Bits.\n\nSemgrep is developed and commercially supported by [Semgrep, Inc., a software security company](https://semgrep.dev).\n\n### Semgrep Rules\n\nSemgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python `print()` statements.\n\nRun it online in Semgrep\u2019s Playground by [clicking here](https://semgrep.dev/s/ievans:print-to-logger).\n\n<p align=\"center\">\n <a href=\"https://semgrep.dev/s/ievans:print-to-logger\" target=\"_blank\"><img src=\"https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-example-rules-editor.jpg\" width=\"582\" alt=\"Semgrep rule example for finding Python print() statements\" /></a>\n</p>\n\n#### Examples\n\nVisit [Docs > Rule examples](https://semgrep.dev/docs/writing-rules/rule-ideas/) for use cases and ideas.\n\n| Use case | Semgrep rule |\n| :-------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| Ban dangerous APIs | [Prevent use of exec](https://semgrep.dev/playground/s/lglB) |\n| Search routes and authentication | [Extract Spring routes](https://semgrep.dev/playground/s/Y6wD) |\n| Enforce the use secure defaults | [Securely set Flask cookies](https://semgrep.dev/playground/s/6KwW) |\n| Tainted data flowing into sinks | [ExpressJS dataflow into sandbox.run](https://semgrep.dev/playground/s/qEpR) |\n| Enforce project best-practices | [Use assertEqual for == checks](https://semgrep.dev/playground/s/oEox), [Always check subprocess calls](https://semgrep.dev/playground/s/zENk) |\n| Codify project-specific knowledge | [Verify transactions before making them](https://semgrep.dev/playground/s/p8zk) |\n| Audit security hotspots | [Finding XSS in Apache Airflow](https://semgrep.dev/playground/s/KPwj), [Hardcoded credentials](https://semgrep.dev/playground/s/2Br8) |\n| Audit configuration files | [Find S3 ARN uses](https://semgrep.dev/playground/s/jEKD) |\n| Migrate from deprecated APIs | [DES is deprecated](https://semgrep.dev/playground/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated), [Deprecated Flask APIs](https://semgrep.dev/playground/r/python.flask.maintainability.deprecated.deprecated-apis.flask-deprecated-apis), [Deprecated Bokeh APIs](https://semgrep.dev/playground/r/python.bokeh.maintainability.deprecated.deprecated_apis.bokeh-deprecated-apis) |\n| Apply automatic fixes | [Use listenAndServeTLS](https://semgrep.dev/playground/s/1Ayk) |\n\n### Extensions\n\nVisit [Docs > Extensions](https://semgrep.dev/docs/extensions/) to learn about using Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!\n\n### Documentation\n\nBrowse the full Semgrep [documentation on the website](https://semgrep.dev/docs). If you\u2019re new to Semgrep, check out [Docs > Getting started](https://semgrep.dev/docs/getting-started/) or the [interactive tutorial](https://semgrep.dev/learn).\n\n### Metrics\n\nUsing remote configuration from the [Registry](https://semgrep.dev/r) (like `--config=p/ci`) reports pseudonymous rule metrics to semgrep.dev.\n\nUsing configs from local files (like `--config=xyz.yml`) does **not** enable metrics.\n\nTo disable Registry rule metrics, use `--metrics=off`.\n\nThe Semgrep [privacy policy](https://semgrep.dev/docs/metrics) describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.\n\n### More\n\n- [Frequently asked questions (FAQs)](https://semgrep.dev/docs/faq/)\n- [Contributing](https://semgrep.dev/docs/contributing/contributing/)\n- [Build instructions for developers](INSTALL.md)\n- [Ask questions in the Semgrep community Slack](https://go.semgrep.dev/slack)\n- [CLI reference and exit codes](https://semgrep.dev/docs/cli-usage)\n- [Semgrep YouTube channel](https://www.youtube.com/c/semgrep)\n- [License (LGPL-2.1)](LICENSE)\n- [Licensing Semgrep](https://semgrep.dev/docs/licensing/)\n\n### Upgrading\n\nTo upgrade, run the command below associated with how you installed Semgrep:\n\n```sh\n# Using Homebrew\n$ brew upgrade semgrep\n\n# Using pip\n$ python3 -m pip install --upgrade semgrep\n\n# Using Docker\n$ docker pull semgrep/semgrep:latest\n```\n",
"bugtrack_url": null,
"license": null,
"summary": "Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.",
"version": "1.69.0",
"project_urls": {
"Homepage": "https://github.com/returntocorp/semgrep"
},
"split_keywords": [],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "c5977574888faea6ed891f8ccc1180bd65255f5cd7d9988da263ab3d9801d9b1",
"md5": "a9dac74bb967a55b6bd0dd8558815c3a",
"sha256": "40513c373196da490fe71b666d7831135380c73eb3ecc4fcc16fc498854c8071"
},
"downloads": -1,
"filename": "semgrep-1.69.0-cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311-none-any.whl",
"has_sig": false,
"md5_digest": "a9dac74bb967a55b6bd0dd8558815c3a",
"packagetype": "bdist_wheel",
"python_version": "cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311",
"requires_python": ">=3.8",
"size": 27295051,
"upload_time": "2024-04-16T01:59:32",
"upload_time_iso_8601": "2024-04-16T01:59:32.641658Z",
"url": "https://files.pythonhosted.org/packages/c5/97/7574888faea6ed891f8ccc1180bd65255f5cd7d9988da263ab3d9801d9b1/semgrep-1.69.0-cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "76f480b1ab058c46e0a6df07034b02e2460368cb819eadc9f84340e7d6ab181f",
"md5": "c194110f8b47a068e4862ea6880c4faf",
"sha256": "a16639eeb42fc633088738d1eb672921598aca799d177cd038b3070636dfd628"
},
"downloads": -1,
"filename": "semgrep-1.69.0-cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311-none-macosx_10_14_x86_64.whl",
"has_sig": false,
"md5_digest": "c194110f8b47a068e4862ea6880c4faf",
"packagetype": "bdist_wheel",
"python_version": "cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311",
"requires_python": ">=3.8",
"size": 27897769,
"upload_time": "2024-04-16T01:59:38",
"upload_time_iso_8601": "2024-04-16T01:59:38.694169Z",
"url": "https://files.pythonhosted.org/packages/76/f4/80b1ab058c46e0a6df07034b02e2460368cb819eadc9f84340e7d6ab181f/semgrep-1.69.0-cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311-none-macosx_10_14_x86_64.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "b50cec6fa25abb3a3975ad3fcf85a5d7b318110cb8d8e7bbe6669a094881265d",
"md5": "7317de4f5d67adcda2e7a7956167b417",
"sha256": "2f678591a873c1f0733dcc7b66af8d86d809bc1ab95b5bd9e26d58350ddd580a"
},
"downloads": -1,
"filename": "semgrep-1.69.0-cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311-none-macosx_11_0_arm64.whl",
"has_sig": false,
"md5_digest": "7317de4f5d67adcda2e7a7956167b417",
"packagetype": "bdist_wheel",
"python_version": "cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311",
"requires_python": ">=3.8",
"size": 33685861,
"upload_time": "2024-04-16T01:59:44",
"upload_time_iso_8601": "2024-04-16T01:59:44.599895Z",
"url": "https://files.pythonhosted.org/packages/b5/0c/ec6fa25abb3a3975ad3fcf85a5d7b318110cb8d8e7bbe6669a094881265d/semgrep-1.69.0-cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311-none-macosx_11_0_arm64.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "47183ec370f1a10ea92f6210609e77f1b145b10a28b52d484ab9104b3255083b",
"md5": "870da71d6e86005f54b7a58b2403da86",
"sha256": "1357c64f94ced836cfe2862d911b3bf788d718ea7be6ade8fb194e6a8f04ecb9"
},
"downloads": -1,
"filename": "semgrep-1.69.0-cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311-none-musllinux_1_0_aarch64.manylinux2014_aarch64.whl",
"has_sig": false,
"md5_digest": "870da71d6e86005f54b7a58b2403da86",
"packagetype": "bdist_wheel",
"python_version": "cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311",
"requires_python": ">=3.8",
"size": 44063339,
"upload_time": "2024-04-16T01:59:49",
"upload_time_iso_8601": "2024-04-16T01:59:49.436045Z",
"url": "https://files.pythonhosted.org/packages/47/18/3ec370f1a10ea92f6210609e77f1b145b10a28b52d484ab9104b3255083b/semgrep-1.69.0-cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311-none-musllinux_1_0_aarch64.manylinux2014_aarch64.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "886d09a15143a884dad5a8fe3e539d2ed084bc4d107a9d3ee4c7d6b2ba14ed0f",
"md5": "9640cedc23064fcbea1bd5d525c6723b",
"sha256": "8de45ed8a0ff4fc1ada3c23e08a6972407e34b2d99fc24ad52e17d0775bceff6"
},
"downloads": -1,
"filename": "semgrep-1.69.0.tar.gz",
"has_sig": false,
"md5_digest": "9640cedc23064fcbea1bd5d525c6723b",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.8",
"size": 26874152,
"upload_time": "2024-04-16T01:59:53",
"upload_time_iso_8601": "2024-04-16T01:59:53.846274Z",
"url": "https://files.pythonhosted.org/packages/88/6d/09a15143a884dad5a8fe3e539d2ed084bc4d107a9d3ee4c7d6b2ba14ed0f/semgrep-1.69.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-04-16 01:59:53",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "returntocorp",
"github_project": "semgrep",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"circle": true,
"lcname": "semgrep"
}
