Semgrep Static Analysis

When to Use Semgrep

Ideal scenarios:

• Quick security scans (minutes, not hours)
• Pattern-based bug detection
• Enforcing coding standards and best practices
• Finding known vulnerability patterns
• Single-file analysis without complex data flow
• First-pass analysis before deeper tools

Consider CodeQL instead when:

• Need interprocedural taint tracking across files
• Complex data flow analysis required
• Analyzing custom proprietary frameworks

Installation

# pip
pip install semgrep

# Homebrew
brew install semgrep

# Docker
docker run --rm -v "${PWD}:/src" returntocorp/semgrep semgrep --config auto /src

Core Workflow

1. Quick Scan

semgrep --config auto .                    # Auto-detect rules
semgrep --config auto --metrics=off .      # Disable telemetry

2. Use Rulesets

semgrep --config p/<RULESET> .             # Single ruleset
semgrep --config p/security-audit --config p/trailofbits .  # Multiple

Ruleset	Description
p/default	General security and code quality
p/security-audit	Comprehensive security rules
p/owasp-top-ten	OWASP Top 10 vulnerabilities
p/cwe-top-25	CWE Top 25 vulnerabilities
p/trailofbits	Trail of Bits security rules
p/python	Python-specific
p/javascript	JavaScript-specific
p/rust	Rust-specific

3. Output Formats

semgrep --config p/security-audit --sarif -o results.sarif .  # SARIF
semgrep --config p/security-audit --json -o results.json .    # JSON
semgrep --config p/security-audit --dataflow-traces .         # Show data flow

Writing Custom Rules

Basic Structure

rules:
  - id: hardcoded-password
    languages: [python]
    message: "Hardcoded password detected: $PASSWORD"
    severity: ERROR
    pattern: password = "$PASSWORD"

Pattern Syntax

Syntax	Description	Example
...	Match anything	func(...)
$VAR	Capture metavariable	$FUNC($INPUT)
<... ...>	Deep expression match	<... user_input ...>

Pattern Operators

Operator	Description
pattern	Match exact pattern
patterns	All must match (AND)
pattern-either	Any matches (OR)
pattern-not	Exclude matches
pattern-inside	Match only inside context
pattern-not-inside	Match only outside context
metavariable-regex	Regex on captured value

Combining Patterns

rules:
  - id: sql-injection
    languages: [python]
    message: "Potential SQL injection"
    severity: ERROR
    patterns:
      - pattern-either:
          - pattern: cursor.execute($QUERY)
          - pattern: db.execute($QUERY)
      - pattern-not:
          - pattern: cursor.execute("...", (...))
      - metavariable-regex:
          metavariable: $QUERY
          regex: .*\+.*|.*\.format\(.*|.*%.*

Taint Mode (Data Flow)

Taint mode tracks data through assignments and transformations:

rules:
  - id: command-injection
    languages: [python]
    message: "User input flows to command execution"
    severity: ERROR
    mode: taint
    pattern-sources:
      - pattern: request.args.get(...)
      - pattern: request.form[...]
      - pattern: request.json
    pattern-sinks:
      - pattern: os.system($SINK)
      - pattern: subprocess.call($SINK, shell=True)
      - pattern: subprocess.run($SINK, shell=True, ...)
    pattern-sanitizers:
      - pattern: shlex.quote(...)
      - pattern: int(...)

CI/CD Integration (GitHub Actions)

name: Semgrep
on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 0 1 * *'  # Monthly

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run Semgrep
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            semgrep ci --baseline-commit ${{ github.event.pull_request.base.sha }}
          else
            semgrep ci
          fi
        env:
          SEMGREP_RULES: >-
            p/security-audit
            p/owasp-top-ten
            p/trailofbits

Configuration

.semgrepignore

tests/
fixtures/
**/testdata/
generated/
vendor/
node_modules/

Suppress False Positives

password = get_from_vault()  # nosemgrep: hardcoded-password
dangerous_but_safe()         # nosemgrep

Rationalizations to Reject

Shortcut	Why It's Wrong
"Semgrep found nothing, code is clean"	Semgrep is pattern-based; can't track complex data flow
"I wrote a rule, so we're covered"	Rules need testing; false negatives are silent
"Too many findings = noisy tool"	High finding count often means real problems

Resources

• Registry: https://semgrep.dev/explore
• Playground: https://semgrep.dev/playground
• Docs: https://semgrep.dev/docs/
• Trail of Bits Rules: https://github.com/trailofbits/semgrep-rules

Attribution

Based on trailofbits/skills semgrep skill.