هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.
ماذا يفعل
Semgrep parses code in 30+ languages and matches patterns: SQL built from user input, eval, weak crypto, missing auth checks, dangerous Dockerfile or Terraform settings. Rules are YAML and readable, so you can write your own in minutes. Rule packs like p/owasp-top-ten, p/python, p/secrets come from the Semgrep registry. In CI it scans only the changed lines of a PR (--baseline-commit).
The open-source CLI is free; the Semgrep platform adds dashboards and cross-file analysis.
طريقة الكتابة
semgrep scan [--config RULES] [OPTIONS] [PATH]الأجزاء الرئيسية
Rule fields
id/message/severity- Name, text, ERROR|WARNING|INFO.
languages- Which languages.
pattern/patterns/pattern-either- What to match.
pattern-not/pattern-inside- Exclusions and context.
metavariables($X)- Placeholders that match any expression.
fix- Autofix text.
الخيارات 9
الأكثر استخدامًا
Flags
لا يوجد شيء يطابق هذا الفلتر.
أمثلة 10
$ مستخدم عادي# بصلاحية root (أو مع sudo)
1Scan with the recommended rules
semgrep scan --config auto --metrics off .2OWASP and language packs
semgrep scan --config p/owasp-top-ten --config p/python .3Fail CI on errors only
semgrep scan --config p/ci --error --severity ERROR .4Only new findings in a PR
semgrep scan --config p/default --baseline-commit origin/main --error5SARIF for GitHub code scanning
semgrep scan --config p/default --sarif -o semgrep.sarif .6Write your own rule
cat rules/no-shell-true.yml rules: - id: subprocess-shell-true message: subprocess with shell=True and a variable can lead to command injection severity: ERROR languages: [python] patterns: - pattern: subprocess.$FUNC(..., shell=True, ...) - pattern-not: subprocess.$FUNC("...", shell=True, ...) semgrep scan --config rules/ .7Test a rule quickly on one pattern
semgrep -e 'yaml.load($X)' -l python .8Scan Dockerfiles and Terraform
semgrep scan --config p/dockerfile --config p/terraform .9Run in a container (no install)
docker run --rm -v "$PWD:/src" semgrep/semgrep semgrep scan --config auto --metrics off10Ignore one line with a reason
grep -n "nosemgrep" app/legacy.py 42: os.system(cmd) # nosemgrep: subprocess-shell-true -- fixed input from config, ticket SEC-88
لا يوجد شيء يطابق هذا الفلتر.
انتبه
- Rules find patterns, not every bug; combine SAST with tests, review and DAST (ZAP).
- Too many low findings make people ignore the tool: start with ERROR severity in CI.
الملفات
.semgrepignore- Paths to skip.
.semgrep.yml / rules/- Your own rules.
نصائح للحفظ
- Turn every bug found in review into a small Semgrep rule, so it never comes back.
رموز الخروج
0 | No blocking findings. |
1 | Findings with --error. |
2 | Error (bad rule or config). |