June 2021 Summaries

GitLab's transition from Bandit and ESLint to Semgrep for SAST (Static Application Security Testing) analyzers brings a nuanced comparison between these tools in terms of security coverage, custom rule creation, performance, and CI/CD usage. Semgrep, with access to a wide-ranging community-maintained registry, can handle multiple languages and is easily adaptable with rapid rule modifications, though it tends to produce more false positives compared to ESLint, which offers more precise security checks for JavaScript. The analysis highlights that while ESLint is faster and more efficient on larger repositories, Semgrep's multithreading capabilities can enhance its performance on smaller to medium-sized projects. Both tools integrate well into development workflows and CI/CD systems, offering flexible options for ignoring lines, paths, and specific rules. Semgrep's multilingual support and experimental features like autofix make it a versatile choice for multi-language projects, although ESLint's detailed rule testing and fewer false positives present a robust alternative for JavaScript security analysis.

Semgrep has integrated with GitLab, offering two main pathways for use: GitLab SAST and Semgrep CI. In GitLab SAST, Semgrep now serves as the default analyzer for JavaScript, Python, and TypeScript, replacing Bandit and ESLint, and allowing for simplified custom rule development with language-agnostic scanning. Through Semgrep CI, GitLab users can incorporate Semgrep into their CI/CD workflows to leverage over 1,000 community-driven rules and create custom rules with Semgrep’s intuitive syntax. Semgrep scan results appear in merge request discussions, facilitating integration into existing developer workflows, and optimizing performance by enabling faster scans through merge request triggers. GitLab is transitioning more of its SAST analyzers to Semgrep and aims to expand support to additional languages while contributing to the Semgrep open-source project and rule registry.

GitLab announced a transition from Bandit and ESLint to Semgrep for SAST analyzers, beginning with the GitLab 14.0 release. Semgrep offers a broader range of community-maintained rules across multiple programming languages, while Bandit is focused on Python with fewer but more precise rules. Semgrep allows for rapid customization and extension of rules, which makes it versatile and adaptable to varying security needs. Both tools can be integrated into CI/CD pipelines and support ignoring specific lines of code or paths, but Semgrep’s multilingual capabilities enable it to handle multi-language projects. Despite Semgrep's slower performance on smaller repositories due to setup overhead, it matches Bandit's speed on larger repositories, particularly when multithreading is enabled. Additionally, both tools facilitate rule testing and custom rule creation, with Semgrep offering a more straightforward pattern syntax.

Semgrep v0.52.0 has advanced its C# support from development to alpha stage, boasting an estimated 97% parsing accuracy and enabling the use of metaviables and ellipsis in expressions and statements. This development allows users to write practical rules, with the first set contributed by Ahmet Akan, and the team is seeking early testers to identify bugs and contribute additional rules. The platform provides examples, tutorials, and documentation to assist users in writing Semgrep rules, and encourages those interested to upgrade or install Semgrep and consider integrating it into their CI pipelines. This milestone was largely achieved through the contributions of Sjoerd Langkemper, who significantly advanced C# support since August 2020, and there are plans to further promote C# support to beta in the coming months.