May 2022 Summaries

Semgrep is a lightweight, fast tool designed for enforcing good coding practices by analyzing individual files, but this approach can be limited for detecting complex bugs across multiple files. To address this, DeepSemgrep, a proprietary extension, has been developed to enhance Semgrep's capabilities by performing global analysis and inter-file examination without requiring code compilation. This extension improves accuracy by reducing false negatives and positives through features like inter-file constant propagation, type inference, and taint tracking. DeepSemgrep is available in private beta for Team and Enterprise tiers, allowing users to leverage the same rule syntax as Semgrep while gaining the ability to analyze entire codebases more effectively. The tool enhances the detection of issues such as the flow of tainted data across different files and recognizing class inheritance, thereby broadening the scope and reliability of code analysis.

Semgrep has enhanced its static analysis tool with several significant updates aimed at improving its effectiveness and user experience. The introduction of DeepSemgrep, a private beta extension, allows cross-file analysis for Java and Ruby, reducing false positives and negatives by analyzing complex vulnerabilities that span multiple files. This complements Semgrep's existing features, which are valued for their speed and simplicity. The new Playground offers a more developer-friendly interface, enabling users to write, test, and share rules more efficiently, aligning its functionality with the Editor. Additionally, Semgrep now supports GitHub Enterprise and GitLab Self-Managed, allowing inline comments for security issues, and introduces Autofix suggestions for developers to implement code fixes directly from their platforms. A default ruleset has also been added to provide optimal results without extra configuration, reinforcing Semgrep’s position as a preferred tool among security engineers for identifying vulnerabilities.