3 ms·

The cli is here: https://semgrep.dev/docs/getting-started/ https://semgrep.dev/docs/getting-started/ You can write stuff like # Check for Python == where

The cli is here: https://semgrep.dev/docs/getting-started/ https://semgrep.dev/docs/getting-started/ You can write stuff like # Check for Python == where the left and right hand sides are the same (often a bug) $ semgrep -e '$X == $X' --lang=py path/to/src

enriquto 6y ago
Cool! But this example is a bit simplistic since it can be done just as easily by regular grep: grep -E '(.+) = \1' *.py I have trouble looking at the examples in the project website (many things inside iframes are adblocked). Do you have any example of a search that would be difficult or impossible with grep?
- SavantIdiot 6y ago
  It can infer (x==y) if x=1 and y=1, which is grep cannot do.
  - enriquto 6y ago
    This must surely fail... isn't it equivalent to solving the halting problem? Or does it run the whole program like a debugger?
    - Quekid5 6y ago
      If false negatives are permitted the halting problem isn't an issue.
    - Spivak 6y ago
      It fails pretty fast. import random y = 0 def f(x): print(x) if random.randint(0,1) == 2: y = 1 f(y) This not only fails but crashes the program.
- fragmede 6y ago
  If you're that capable with grep, surely you've run into it's shortcomings and can appreciate attempts to improve the status quo. Like trying to find usages of a variable that is a substring of a word. Like trying to fix code where somebody else has used the variable name i. Sure, you can add matching on word boundaries, but then it starts to become a distraction from the original task at hand.
- mdaniel 6y ago
  Your example matches the _text_, semgrep matches _the language_ given: if 1 \ == \ 1: pass then $ semgrep -e '$X == $X' -l python 1:if 1 \ 2: == \ 3: 1: ran 1 rules on 1 files: 1 findings to follow myself up, one can also check for expressions like what I used as an example and say "don't do that", but without regard to what is inside the if semgrep -e $'if ...:\n pass\n' -l python

enriquto 6y ago

Cool! But this example is a bit simplistic since it can be done just as easily by regular grep: grep -E '(.+) = \1' *.py I have trouble looking at the examples in the project website (many things inside iframes are adblocked). Do you have any example of a search that would be difficult or impossible with grep?

SavantIdiot 6y ago
It can infer (x==y) if x=1 and y=1, which is grep cannot do.
- enriquto 6y ago
  This must surely fail... isn't it equivalent to solving the halting problem? Or does it run the whole program like a debugger?
  - Quekid5 6y ago
    If false negatives are permitted the halting problem isn't an issue.
  - Spivak 6y ago
    It fails pretty fast. import random y = 0 def f(x): print(x) if random.randint(0,1) == 2: y = 1 f(y) This not only fails but crashes the program.
fragmede 6y ago
If you're that capable with grep, surely you've run into it's shortcomings and can appreciate attempts to improve the status quo. Like trying to find usages of a variable that is a substring of a word. Like trying to fix code where somebody else has used the variable name i. Sure, you can add matching on word boundaries, but then it starts to become a distraction from the original task at hand.
mdaniel 6y ago
Your example matches the _text_, semgrep matches _the language_ given: if 1 \ == \ 1: pass then $ semgrep -e '$X == $X' -l python 1:if 1 \ 2: == \ 3: 1: ran 1 rules on 1 files: 1 findings to follow myself up, one can also check for expressions like what I used as an example and say "don't do that", but without regard to what is inside the if semgrep -e $'if ...:\n pass\n' -l python