May 2023 Summaries

Romain Jufer, CSO of AVNU, announces the experimental support of the Cairo 1.0 programming language in Semgrep, enhancing the development of secure smart contracts on the Starknet blockchain. Cairo joins Solidity as the second blockchain programming language supported by Semgrep, which already supports over 30 other languages. The importance of software security in smart contracts is highlighted, noting past financial losses and reputational damage from attacks. Jufer, with a background in cybersecurity, emphasizes Semgrep's usefulness in identifying code issues and its flexibility in creating custom rules, which is crucial for developing robust smart contracts in Cairo 1.0. Collaboration with Starkware and the community aims to improve Cairo 1.0 support and develop a ruleset, with an invitation for others to join the effort. Acknowledgment is given to Yoann Padioleau for his critical role in the integration process.

Semgrep has expanded its Pro Engine to include cross-file analysis for Go (Golang), a popular programming language known for its speed and simplicity. This update is part of Semgrep's ongoing effort to enhance its code analysis capabilities across multiple languages and provide security engineers and developers with accurate and customizable tools. The introduction of 50+ new Go rules targets popular frameworks like Gin, gRPC, Gorilla, and net/http, as well as addressing potential vulnerabilities such as hardcoded secrets and command injection. Users can integrate Semgrep Pro Engine's Go support by adding a GitHub or GitLab project to Semgrep Code for automated scanning on pull or merge requests, or by upgrading to Semgrep v1.22.0 or higher for command-line usage. Semgrep encourages community feedback to guide future language support expansions.

Semgrep, a versatile static and software composition analysis tool supporting over 25 languages, has announced experimental support for the Julia programming language as part of its mission to enhance software security across language boundaries. With a parse rate of 99.3%, nearing "beta" status, Semgrep incorporates basic functionalities like metavariables and ellipses in its matching engine. The adoption of Julia was made possible through collaboration with Avik Sengupta of JuliaHub and Sergio Vargas, who revamped the Julia tree-sitter grammar crucial for parsing. Although the Semgrep Registry currently lacks Julia-specific rules, users can create their own, such as rules for avoiding the direct opening of files in the /tmp directory and checking for unused function parameters. These efforts aim to promote best practices and improve code correctness within the Julia community.