September 2022 Summaries

Software Composition Analysis (SCA) tools are essential for managing security risks associated with open-source libraries but are often criticized for being overly noisy and generating false positives. This noise leads to frustration and inefficiencies among AppSec teams and developers due to the tools' inability to differentiate between actual vulnerabilities and benign instances. The blog post highlights the limitations of traditional SCA tools, exemplified by their tendency to flag every instance of a library as vulnerable without considering the specific usage context. The proposed solution is reachability analysis, which more precisely identifies when and how vulnerable methods are utilized, thereby reducing unnecessary alerts and improving collaboration between security and development teams. The introduction of tools like Semgrep Supply Chain aims to enhance this approach by focusing on real threats, helping prioritize critical issues, and reducing cross-team friction.

Semgrep has expanded its static analysis capabilities by reaching experimental status for the Swift programming language, achieving a 94% parse rate thanks to the Swift Tree-sitter grammar developed by Alex Pinkus. This advancement allows basic Semgrep features, such as pattern matching and metavariables, to function correctly with Swift. While no Swift-specific rules exist in the registry yet, users can write custom rules to scan their Swift code or set up Semgrep to automatically analyze codebases for changes via GitHub or GitLab integrations. Users are encouraged to contribute by creating Swift rules or reporting issues, and they can find support through the community Slack and documentation resources.

Semgrep’s taint mode is a powerful tool designed to track the flow of potentially unsafe data through a codebase, helping to identify vulnerabilities such as injection attacks. Unlike the default search mode, which looks for specific patterns, taint mode traces data flow across multiple variables, making it particularly useful for detecting complex scenarios like cross-site scripting (XSS) or SQL injection vulnerabilities. Writing a taint mode rule involves specifying sources, sinks, and optionally, sanitizers to refine the rule by ignoring validated data. Additionally, taint propagators can be defined to track how tainted data spreads to other structures, enhancing the rule's effectiveness. By leveraging these features, developers can secure their codebases against a wide range of security threats with greater precision and efficiency.