June 2023 Summaries

Developers are increasingly seeking to integrate static application security testing (SAST) into the early stages of the software development cycle, aiming for simplicity akin to that of linters. However, traditional SAST tools present challenges due to their complexity, which hampers the "shift left" movement in software security practices. Semgrep addresses this issue by offering a fast and user-friendly SAST tool with a new VS Code Extension, which simplifies security checks by providing real-time feedback as code is written. This extension allows developers to catch security vulnerabilities, such as SQL injections and secrets, much like a linter catches syntax errors, and supports custom rule creation through the Semgrep Cloud Platform. The extension operates seamlessly within the developer's environment by scanning only modified lines and files and can be easily expanded to other editors via the Language Server Protocol. This approach not only enhances security by enabling early detection of issues but also facilitates collaborative rule-sharing across development teams, making security checks as integral and straightforward as syntax highlighting in the coding process.

Semgrep Supply Chain has introduced two new features, Dependency Search and License Compliance, to enhance supply chain security and provide users with deeper insights into their dependencies. Dependency Search allows users to query their entire codebase for any dependency at any version, facilitating proactive investigation of vulnerable packages even before CVE disclosures, as demonstrated by a Fortune 100 company that identified potential vulnerabilities quickly. License Compliance helps ensure that non-compliant licenses are flagged during pull requests, promoting awareness of legal constraints in software development. Since its launch, Semgrep Supply Chain has aimed to reduce false positives and streamline the management of open source vulnerabilities, and these features represent the next step in addressing broader supply chain issues.

Semgrep, a fast and open-source static analysis tool, has significantly enhanced its Playground feature, allowing for real-time code scanning by executing Semgrep directly in the browser. This improvement, inspired by Authzed's SpiceDB, eliminates the need for a Run button and introduces "Turbo Mode," which re-scans code after every keystroke. The transition involved compiling Semgrep's OCaml code into JavaScript using the js_of_ocaml compiler and addressing challenges with dependent C libraries by leveraging Emscripten to create a WebAssembly module. A notable challenge was overcoming mismatched architectures between the 64-bit build environment and the 32-bit WebAssembly runtime, particularly affecting YAML parsing, which was resolved with a temporary workaround. This project underscores the importance of speed in enhancing user experience, offering a seamless and instantaneous code analysis tool for developers.

Semgrep has achieved General Availability (GA) support for Kotlin, enhancing its capability as a static application security testing (SAST) tool that now supports over 30 programming languages. The process involved improving the parse rate and rule coverage for Kotlin, with challenges like resolving ambiguities in string interpolation due to Kotlin's syntax being addressed by adjusting pattern parsing strategies. Rule writing focused on creating high-confidence detection for vulnerabilities like XSS and SQL Injection, specifically targeting popular web frameworks such as Ktor and Spring Boot, with the application of Semgrep features like Taint Labels to manage taint-tracking and dataflow-analysis. The successful enhancement of Kotlin support was a collaborative effort, ensuring Semgrep's usefulness in detecting security issues across a wide range of open-source repositories.

Semgrep has announced a series of new features and updates aimed at enhancing software security and reliability, including making Semgrep Supply Chain and Semgrep Code’s Pro features free for teams with up to 10 contributors. These updates include faster GitHub.com scanning, zero-config scanning for GitHub users, and turbo-charged Semgrep Playground that provides instant feedback with every keystroke. Additionally, Semgrep has expanded its language support for Go and Kotlin, introduced a new Policies UI for better rule management, and is set to launch a VS Code Extension that offers immediate feedback on save. Upcoming features such as Dependency Search and License Compliance aim to streamline dependency management and compliance checks for security teams. These enhancements reflect Semgrep's commitment to providing comprehensive security tools without tiered feature restrictions, aligning pricing with its Startup Program, and simplifying user experience across its platform.