February 2022 Summaries

Semgrep, an open-source static analysis tool, has introduced significant updates in February 2022 to enhance collaboration between developers and security teams, streamline rule-writing processes, and improve software reliability through advanced analysis features. The new Developer Feedback feature, available in the Team tier, allows security teams to gauge developer sentiment on rules within CI/CD workflows, fostering better collaboration and reducing unnecessary findings. Additionally, the introduction of the Editor simplifies the creation and management of customized rules, allowing teams to leverage existing rules from the Semgrep registry and create private rules securely. The updates also include extended language support with seven new languages, along with deep analysis capabilities such as symbolic propagation and improved taint-tracking, which enhance security by identifying vulnerabilities more efficiently. These enhancements aim to empower users with a more efficient, user-friendly static analysis experience, supported by a vibrant community for further engagement and assistance.

Symbolic propagation is a new experimental feature in Semgrep that extends constant propagation by allowing pattern matching to consider variable assignments, thus enabling simple patterns to match equivalent code even with intermediate variables. Previously, writing Semgrep rules required enumerating all possible code structures when intermediate variables were used, making it cumbersome to create complex rules. With symbolic propagation, introduced in Semgrep version 0.78.0, users can simply set the option to true, allowing the matching engine to automatically recognize equivalent code structures, such as method call chains, without explicitly accounting for intermediate assignments. This feature enhances the simplicity and power of writing Semgrep rules, making it easier to handle complex cases and is expected to become a default feature due to its promising capabilities.