Skip to main content

Semgrep release notes for February 2024

🔧 OSS Engine​

🌐 Cloud Platform​

Added​

  • API: Added a rule object under findings with the following fields:
    • name
    • message
    • confidence
    • category
    • subcategories
    • technologies
    • vulnerability_classes
    • cwe_names
    • owasp_names
  • Added distinction between Pro engine and OSS findings in the Playground and Editor.
  • Added support for the linux-arm64 platform when you download Semgrep Pro Engine.

Changed​

  • Updated the Semgrep Cloud Platform (SCP) login page.
  • Updated the login process from the CLI to SCP. This change affects new users.
  • Updated the Semgrep installation instructions for Docker.
  • Improved performance of Semgrep Playground and Editor.

Fixed​

  • Fixed a bug where the navigation sidebar covered the entire mobile screen and could not be collapsed.
  • Scan summary links printed after users run semgrep ci now reflect a custom SEMGREP_APP_URL if set.

💻 Code​

Added​

  • Support for C and C++ is now generally available (GA), including cross-file and cross-function analysis.
  • Added new Pro rules for Elixir and the Phoenix framework, covering various security and correctness issues. These are available in the p/elixir ruleset.
  • Added support for Python, with a focus on the Flask ecosystem, to the Semgrep Pro Engine.
  • Added support for nested record patterns on the left-hand side of an assignment during dataflow analysis. For example, given { body: { param } } = tainted, Semgrep correctly marks param as tainted.
  • The metavariable-regex operator can now match on metavariables of interpolated strings that use variables with known values.
  • Taint analysis:
    • Added support for Python constructors.
    • Added support for index sensitivity. Semgrep tracks taint on individual indexes of a data structure when these are constant values, either integers or strings, and the code uses the built-in syntax for array indexing.
    • Added exact: false as a pattern-sources sub-key so you can specify that anything inside a code region is a sink: 
          pattern-sources:
            - exact: false
              pattern: ...
    • When exact: true and taint_assume_safe_functions: true, Semgrep now considers that, if the specified formula isn't a patterns with a focus-metavariable, it must look for taint in the function call's arguments. For example: 
      ...
      options:
        taint_assume_safe_functions: true
      pattern-sources:
        - exact: false
          pattern: ...

Changed​

  • Improved error handling during interfile analysis so Semgrep Code doesn't crash.
  • CLI: If there are multiple errors resulting from the user running Pro rules without a license, the CLI groups all errors and reports a single warning.
  • The project name for repositories scanned locally is local_scan/<repo_name> instead of <repo_name>.
  • The View Results URL displayed for findings now includes the repository and branch names.

Fixed​

  • Fixed an issue with incorrect autofix application where multiple fixes were applied to the same line.
  • Fixed issue where tokens for type parameter brackets weren't stored correctly. They're now stored in the generic AST, allowing Semgrep to autofix these constructs correctly.
  • Fixed an issue where Semgrep doesn't support multiple labels for taint traces. Now, Semgrep looks at the requires of the sink, and if it has the shape A and ..., it picks A as the preferred label and reports the trace.
  • Fixed issue where taint signatures don't capture changes to parameter fields.

⛓️ Supply Chain​

Added​

  • Added support for parsing Swift Package Manager manifest files and lock files.
  • Added the ability to filter for dependencies that Semgrep has commented on.
  • Added manual review advice to GitHub PR comments. Certain Semgrep Supply Chain (SSC) findings require manual review to verify if the finding is reachable or not.

Fixed​

  • Fixed issues with trailing newline parsing in pyproject.toml and poetry.lock files.

🔐 Secrets​

Added​

  • Added the following new rules:
    • Detection rules for Azure and AWS
    • Semantic secrets rules for Python, JavaScript, and TypeScript
    • Semantic rules for hard-coded credentials in bash for curl commands
  • Added non-validator regex detection for databases, including MongoDB, Microsoft SQL Server, MySQL, Postgres, and Redis
  • Added secrets rule management, which is accessible in Semgrep Cloud Platform by going to Rules > Policies > Secrets. This allows you to:
    • See all available rules
    • Set valid finding modes for the rules
    • Set invalid and error validation state modes across multiple rules

Fixed​

  • Fixed an issue where the Analysis method filter in Semgrep Cloud Platform wasn't filtering correctly.

📝 Documentation and knowledge base​

Added​

Changed​

Fixed​

  • Fixed formatting on GitHub PR comments documentation. Thank you to parsiya for the fix.
  • Various link fixes and Docker image updates.

Not finding what you need in this doc? Ask questions in our Community Slack group, or see Support for other ways to get help.