Detect Complex Code Patterns Using Semantic Grep - OWASP ATL Meeting - Jan 2021 скачать в хорошем качестве

Detect Complex Code Patterns Using Semantic Grep - OWASP ATL Meeting - Jan 2021

Sabrina Brogren(@sabihb) from rc2 joined us to discuss a tool a program analysis tool their developing called Semgrep. It's a multilingual semantic tool for writing security and correctness queries on source code (for Python, Java, Go, C, and JS) with a simple “grep-like” interface. The original author, Yoann Padioleau, worked on Semgrep’s predecessor, Coccinelle, for Linux kernel refactoring, and later developed Semgrep while at Facebook. He’s now full time with us at r2c. Semgrep is a free open-source program analysis toolkit that finds bugs using custom analysis we’ve written and OSS code checks. Semgrep is ideal for security researchers, product security engineers, and developers who want to find complex code patterns without extensive knowledge of ASTs or advanced program analysis concepts.