This is an repository containing rules written for semgrep, organized by language. Go to the main semgrep documentation for details on semgrep and the syntax for the yaml files in this repository.

branch	using semgrep docker image	test status
master	returntocorp/semgrep:latest
develop	returntocorp/semgrep:develop

We welcome contributions to this repo! Please fork and make a pull request; we'll contact you about signing our CLA.

If you want run these rules rather than write them, check out the easy-to-use bento.dev

Join slack for the fastest answers to your questions! Or contact the team at [email protected].

A testing system is available which can be used to check the rules against example source code files. It requires semgrep from semgrep

If you wrote a rule in a yaml named eqeq-bad.yaml with a rule id named my-eqeq-bad, you could put a file in the same directory named eqeq-bad.py (it just needs to have the same name except for the extension as eqeq-bad.yaml). Then:

# ruleid:my-eqeq-bad
x == x

Running make test will execute the test suite, and if my-eqeq-bad does not fire on the line below the comment, your rule will fail.

If you have a rule that is not working, but you want to commit it soo it's documented but not fail the tests, use #todoruleid:...:

# todoruleid:my-eqeq-bad
x != x

If you fork this repo or create your own, you can add a special semgrep-rules-test Github Action to your workflow that will automatically test your rules by running make test using the latest version of semgrep.

See ours here