Awesome

Trail of Bits public Semgrep rules

This repository contains Semgrep rules developed by Trail of Bits and made available to the public. They are part of our ongoing development efforts and are used in our security audits, vulnerability reseach, and internal projects. They will evolve over time as we identify new techniques.

Visit Testing Handbook for Semgrep guidance.

Using Semgrep

The easiest way to run the rules is to run them from the Semgrep registry. To do so, navigate to the root folder of your project and run the following:

$ semgrep --config "p/trailofbits"

Alternatively, you can clone this repository, navigate to the root folder of your project, and run individual rules using the command below :

$ semgrep --config /path/to/semgrep-rules/semgreprule.yml

To run all rules from the cloned repository:

$ semgrep --config /path/to/semgrep-rules/ .

Useful flags

Semgrep will run against all supported code files except for those in your .gitignore file. If you want to run the rules against all files and directories, including those in your .gitignore, add the --no-git-ignore flag.

$ semgrep --config /path/to/semgrep-rules/ . --no-git-ignore

You can also tell Semgrep to ignore files and directories that match any pattern. For instance, if you want to tell Semgrep to ignore all Go test files you can run the following:

$ semgrep --config /path/to/semgrep-rules/ . --exclude='*_test.go'

Use -o to output results to a file:

$ semgrep --config /path/to/semgrep-rules/hanging-goroutine.yml -o leaks.txt'

Rules

go

python

rs

javascript

Contributing

Pull Requests and issues are welcomed!

See CONTRIBUTING.md for more information.

Licensing

The rules defined in this repository are licensed under AGPLv3.

The sidecar examples may be derived from other works, and retain their original licenses where required.