4 ms·

This looks neat, but I'm still not sure I quite get it. Do I understand correctly that earlier tools helped you use, e.g., ESLint, but now it replaces ESLint an

This looks neat, but I'm still not sure I quite get it. Do I understand correctly that earlier tools helped you use, e.g., ESLint, but now it replaces ESLint and does the linting itself? Or is it still something of an orchestrator of different underlying linters?

underyx 5y ago
Semgrep replaces ESLint’s security rules. We have a ruleset[0] which shows you how we reimplemented the eslint security plugin’s rules with our pattern matching language. I’m not sure why there’s a mismatch in the number of rules between the original and our implementation; perhaps a more eye-catching example is GitLab’s re-implementation of Bandit’s rules[1]. GitLab used to bundle Bandit in their SAST analyzer, but they recently switched over to generating the same results via Semgrep[2], as our tool is faster and they can replace many of their linter integrations with it. [0]: https://semgrep.dev/p/eslint-plugin-security https://semgrep.dev/p/eslint-plugin-security [1]: https://semgrep.dev/p/gitlab-bandit https://semgrep.dev/p/gitlab-bandit [2]: https://r2c.dev/blog/2021/introducing-semgrep-for-gitlab/#semgrep-in-gitlab-sast https://r2c.dev/blog/2021/introducing-semgrep-for-gitlab/#se...
underyx 5y ago
Oh, silly me. I totally forgot that the GitLab team reimplemented also a set of ESLint rules in Semgrep[0], just like I mentioned they did with Bandit. We published an in-depth comparison with ESLint[1] that might clear things up even more. [0]: https://semgrep.dev/p/gitlab-eslint https://semgrep.dev/p/gitlab-eslint [1]: https://r2c.dev/blog/2021/javascript-static-analysis-comparison-eslint-semgrep/ https://r2c.dev/blog/2021/javascript-static-analysis-compari...