Semgrep

https://docs.semgrep.dev/
Admin
Semgrep is a static application security testing tool providing SAST, software composition analysis,...
Tokens:400,230
Snippets:6,129
Trust Score:10
Update:2 months ago
Show doc for...
Tokens:
Raw
### Install dependencies

Source: https://docs.semgrep.dev/contributing/semgrep-core-contributing

Run the setup target to install all necessary dependencies.

```bash
make setup
```

--------------------------------

### GET /api/readiness-check

Source: https://docs.semgrep.dev/api-reference/v2/miscservice/check-container-readiness

Check if the container has started up correctly.

```APIDOC
## GET /api/readiness-check

### Description
Check if container started up correctly.

### Method
GET

### Endpoint
/api/readiness-check

### Response
#### Success Response (200)
- **status** (string) - The status of the container.
- **ready** (boolean) - Indicates if the container is ready.
```

--------------------------------

### GET /api/readiness-check

Source: https://docs.semgrep.dev/api-reference/v2/miscservice/check-container-readiness

Checks if the container has started up correctly. This endpoint is marked as experimental.

```APIDOC
## GET /api/readiness-check

### Description
Check if the container started up correctly.

### Method
GET

### Endpoint
/api/readiness-check
```

--------------------------------

### Build and install ocaml-tree-sitter

Source: https://docs.semgrep.dev/contributing/updating-a-grammar

Standard build and installation commands for the ocaml-tree-sitter environment.

```bash
./configure
make setup
make
make install
```

--------------------------------

### List all projects API request examples

Source: https://docs.semgrep.dev/api-reference/projectsservice/list-all-projects

Examples of how to fetch projects using different programming languages and libraries.

```bash
curl --request GET \
  --url 'https://api.example.com/api/v1/deployments/{deploymentSlug}/projects?page_size=100' \
  --header 'Authorization: Bearer <token>'
```

```python
import requests

url = "https://api.example.com/api/v1/deployments/{deploymentSlug}/projects?page_size=100"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)
```

```javascript
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.example.com/api/v1/deployments/{deploymentSlug}/projects?page_size=100', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));
```

```php
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/v1/deployments/{deploymentSlug}/projects?page_size=100",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/v1/deployments/{deploymentSlug}/projects?page_size=100"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}
```

```java
HttpResponse<String> response = Unirest.get("https://api.example.com/api/v1/deployments/{deploymentSlug}/projects?page_size=100")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/deployments/{deploymentSlug}/projects?page_size=100")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

--------------------------------

### Install development dependencies

Source: https://docs.semgrep.dev/contributing/semgrep-contributing

Install the necessary Python dependencies while skipping the binary installation to use a local semgrep-core.

```bash
SEMGREP_SKIP_BIN=true pipenv install --dev
```

--------------------------------

### Deployment Slug Parameter Example

Source: https://docs.semgrep.dev/api-reference/findingsservice/list-code-supply-chain-or-ai-powered-scan-findings

Example value for the deploymentSlug path parameter.

```text
"your-deployment"
```

--------------------------------

### Install pre-commit

Source: https://docs.semgrep.dev/contributing/contributing-code

Use this command to install the pre-commit tool if it is not already available in your environment.

```bash
python -m pip install pre-commit
```

--------------------------------

### Install dependencies in CI

Source: https://docs.semgrep.dev/semgrep-ci/packages-in-semgrep-docker-1

Example of explicitly installing required utilities within a GitHub Actions workflow to ensure availability.

```yaml
  job:
    container: semgrep/semgrep:latest
    runs-on: ubuntu-latest-16-core
    steps:
      - uses: actions/checkout@v6
      - name: Install dependencies
        run: apk add bash jq curl
      - run: semgrep scan --json ... | jq ...
```

--------------------------------

### Initialize pre-commit hooks

Source: https://docs.semgrep.dev/contributing/contributing-code

Run this command to install the project's pre-commit hooks, which require Docker to be installed.

```bash
pre-commit install
```

--------------------------------

### Example requirements.in input

Source: https://docs.semgrep.dev/kb/semgrep-supply-chain/ssc-python-lockfiles

A sample requirements.in file containing direct dependencies.

```text
numpy
matplotlib==3.*
seaborn==0.10.1
pandas
```

--------------------------------

### GET /api/agent/deployments/{deploymentId}/slack/install

Source: https://docs.semgrep.dev/api-reference/v2/slackservice/get-slack-app-installation-url

Generates the OAuth URL that initiates the Slack app installation flow.

```APIDOC
## GET /api/agent/deployments/{deploymentId}/slack/install

### Description
Generates the OAuth URL that initiates the Slack app installation flow.

### Method
GET

### Endpoint
/api/agent/deployments/{deploymentId}/slack/install

### Parameters
#### Path Parameters
- **deploymentId** (integer) - Required - The ID of the deployment.

### Response
#### Success Response (200)
- **redirect_url** (string) - The URL to redirect the user to for Slack app installation.
```

--------------------------------

### GET /api/agent/deployments/{deploymentId}/slack/install

Source: https://docs.semgrep.dev/api-reference/v2/slackservice/get-slack-app-installation-url

Generates the OAuth URL that initiates the Slack app installation flow for a given deployment.

```APIDOC
## GET /api/agent/deployments/{deploymentId}/slack/install

### Description
Generates the OAuth URL that initiates the Slack app installation flow.

### Method
GET

### Endpoint
/api/agent/deployments/{deploymentId}/slack/install

### Parameters
#### Path Parameters
- **deploymentId** (string) - Required - The unique identifier of the deployment.
```

--------------------------------

### Deployment ID Parameter Example

Source: https://docs.semgrep.dev/api-reference/v2/teamsservice/create-a-deployment-rbac-team

Example value for the deploymentId path parameter.

```json
1111
```

--------------------------------

### Install base dependencies

Source: https://docs.semgrep.dev/contributing/semgrep-core-contributing

Install system-level packages required for compilation.

```bash
brew install pkg-config bash
```

--------------------------------

### List Dependencies Response Example

Source: https://docs.semgrep.dev/api-reference/supplychainservice/list-dependencies

Example JSON response body returned by the API upon a successful request.

```json
{
  "dependencies": [
    {
      "id": "1",
      "name": "dependency1",
      "version": "1.0.0"
    },
    {
      "id": "2",
      "name": "dependency2",
      "version": "2.0.0"
    }
  ],
  "cursor": "<string>",
  "hasMore": true
}
```

```json
[  
  {  
    "id": "1",  
    "name": "dependency1",  
    "version": "1.0.0"  
  },  
  {  
    "id": "2",  
    "name": "dependency2",  
    "version": "2.0.0"  
  }  
]
```

--------------------------------

### GET /api/agent/deployments/{deploymentId}/slack/installations

Source: https://docs.semgrep.dev/api-reference/v2/slackservice/get-slack-installation-details

Retrieves Slack app installation details for a deployment.

```APIDOC
## GET /api/agent/deployments/{deploymentId}/slack/installations

### Description
Retrieves Slack app installation details for a deployment.

### Method
GET

### Endpoint
/api/agent/deployments/{deploymentId}/slack/installations

### Parameters
#### Path Parameters
- **deploymentId** (integer) - Required - The ID of the deployment.

### Response
#### Success Response (200)
- **deployment_id** (integer) - The ID of the deployment.
- **client_id** (string) - The Slack client ID.
- **app_id** (string) - The Slack app ID.
- **enterprise_name** (string) - The name of the enterprise.
- **enterprise_url** (string) - The URL of the enterprise.
- **team_name** (string) - The name of the Slack team.
- **update_available** (boolean) - Indicates if an update is available.
- **archived** (boolean) - Indicates if the installation is archived.
```

--------------------------------

### Install OCaml and OPAM

Source: https://docs.semgrep.dev/contributing/semgrep-core-contributing

Set up the OCaml environment and switch to the required compiler version.

```bash
brew install opam
opam init
opam switch create semgrep 5.3.0
eval $(opam env)
```

--------------------------------

### Install uv on Linux

Source: https://docs.semgrep.dev/kb/semgrep-ci/azure-self-hosted-ubuntu

Use this command to install the uv package manager on your self-hosted runner.

```bash
$ curl -LsSf https://astral.sh/uv/install.sh | sh
```

--------------------------------

### GET /api/agent/deployments/{deploymentId}/slack/installations

Source: https://docs.semgrep.dev/api-reference/v2/slackservice/get-slack-installation-details

Retrieves Slack app installation details for a deployment.

```APIDOC
## GET /api/agent/deployments/{deploymentId}/slack/installations

### Description
Retrieves Slack app installation details for a deployment.

### Method
GET

### Endpoint
/api/agent/deployments/{deploymentId}/slack/installations

### Parameters
#### Path Parameters
- **deploymentId** (string) - Required - The unique identifier of the deployment.
```

--------------------------------

### Statement Matching Examples

Source: https://docs.semgrep.dev/writing-rules/pattern-syntax

Demonstrates statements that match the pattern 'foo'.

```python
x += foo()
return bar + foo
foo(1, 2)
```

--------------------------------

### List Dependencies with cURL

Source: https://docs.semgrep.dev/api-reference/supplychainservice/list-dependencies

Command-line example using cURL to interact with the API.

```bash
curl --request POST \
  --url https://api.example.com/api/v1/deployments/{deploymentId}/dependencies \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "cursor": "<string>",
  "dependencyFilter": {
    "includeArchived": true,
    "license": [
      "<string>"
    ],
    "lockfilePath": "<string>",
    "name": "<string>",
    "packageFilters": [
      {
        "exactNameMatch": true,
        "exactVersion": "<string>",
        "name": "<string>",
        "versionLowerBound": "<string>",
        "versionUpperBound": "<string>"
      }
    ],
    "repositoryId": [
      123
    ],
    "version": "<string>"
  },
  "deploymentId": 123,
  "pageSize": 1000
}
'
```

--------------------------------

### List Dependencies Response Format

Source: https://docs.semgrep.dev/api-reference/supplychainservice/list-dependencies

Example of a successful 200 OK response body.

```json
{
  "dependencies": [
    {
      "id": "1",
      "name": "dependency1",
      "version": "1.0.0"
    },
    {
      "id": "2",
      "name": "dependency2",
      "version": "2.0.0"
    }
  ],
  "cursor": "<string>",
  "hasMore": true
}
```

--------------------------------

### Verify installation

Source: https://docs.semgrep.dev/contributing/semgrep-core-contributing

Check that the semgrep-core binary is functional.

```bash
bin/semgrep-core -help
```

--------------------------------

### Install Semgrep CLI on Linux

Source: https://docs.semgrep.dev/getting-started/quickstart-ce

Use pipx or uv to install the Semgrep CLI on Linux systems.

```bash
# install through pipx (https://pipx.pypa.io/stable/how-to/install-pipx/)
pipx install semgrep

# or, install through uv (https://docs.astral.sh/uv/)
uv tool install semgrep

# confirm installation succeeded by printing the currently installed version
semgrep --version
```

--------------------------------

### Install Semgrep CI via uv

Source: https://docs.semgrep.dev/semgrep-ci/sample-ci-configs

Use this command to install Semgrep CI using the uv tool.

```bash
uv tool install semgrep
```

--------------------------------

### Pro Engine Installation Metrics

Source: https://docs.semgrep.dev/metrics-1

Status and error reporting for Pro Engine installation steps.

```json
true
```

```json
"download-403"
```

--------------------------------

### Example pyproject.toml configuration

Source: https://docs.semgrep.dev/kb/semgrep-supply-chain/ssc-python-lockfiles

A sample configuration file required for Poetry dependency management.

```toml
[build-system]
requires = ["poetry-core>=1.1.0"]
build-backend = "poetry.core.masonry.api"

[tool.poetry]
name = "example-project"
version = "1.0.0"
description = "An example project"
authors = ["Your Name <yourname@example.com>"]

[tool.poetry.dependencies]
python = "^3.9"
requests = "^2.25.1"
numpy = "^1.21.0"

[tool.poetry.dev-dependencies]
pytest = "^6.2.4"
flake8 = "^3.9.2"

[build-system]
requires = ["poetry-core>=1.0.0"]
build-backend = "poetry.core.masonry.api"
```

--------------------------------

### Install Semgrep development dependencies

Source: https://docs.semgrep.dev/contributing/semgrep-contributing

Installs the necessary development dependencies for the Semgrep CLI.

```bash
pipenv install --dev
```

--------------------------------

### Install pipx on Ubuntu

Source: https://docs.semgrep.dev/kb/semgrep-ci/azure-self-hosted-ubuntu

Commands to update the package list, install pipx, and ensure the path is configured for the current user.

```bash
$ sudo apt update
$ sudo apt install pipx
$ pipx ensurepath
```

--------------------------------

### Team Creation Request Schema Example

Source: https://docs.semgrep.dev/api-reference/v2/teamsservice/create-a-deployment-rbac-team

Example values for the team creation request properties.

```json
{
  "name": "my-team",
  "repositoryIds": [
    "1111",
    "1112"
  ],
  "parentTeamId": "4321"
}
```

--------------------------------

### Authenticate and Install Pro Engine

Source: https://docs.semgrep.dev/semgrep-guardian/overview

Log in to your Semgrep account and install the Pro engine to enable advanced scanning features.

```bash
semgrep login && semgrep install-semgrep-pro
```

--------------------------------

### Example generated requirements.txt

Source: https://docs.semgrep.dev/kb/semgrep-supply-chain/ssc-python-lockfiles

The resulting lockfile containing both direct and transitive dependencies.

```text
#
# This file is autogenerated by pip-compile with Python 3.10
# by the following command:
#
#    pip-compile --output-file=requirements.txt
#
contourpy==1.0.7
    # via matplotlib
cycler==0.11.0
    # via matplotlib
fonttools==4.39.4
    # via matplotlib
kiwisolver==1.4.4
    # via matplotlib
matplotlib==3.7.1
    # via
    #   -r requirements.in
    #   seaborn
numpy==1.24.3
    # via
    #   -r requirements.in
    #   contourpy
    #   matplotlib
    #   pandas
    #   scipy
    #   seaborn
packaging==23.1
    # via matplotlib
pandas==2.0.2
    # via
    #   -r requirements.in
    #   seaborn
pillow==9.5.0
    # via matplotlib
pyparsing==3.0.9
    # via matplotlib
python-dateutil==2.8.2
    # via
    #   matplotlib
    #   pandas
pytz==2023.3
    # via pandas
scipy==1.10.1
    # via seaborn
seaborn==0.10.1
    # via -r requirements.in
six==1.16.0
    # via python-dateutil
tzdata==2023.3
    # via pandas
```

--------------------------------

### Install Semgrep CLI

Source: https://docs.semgrep.dev/for-developers/signin

Commands to install the Semgrep CLI tool using pipx, uv, or Homebrew, followed by a version verification check.

```bash
# macOS, Linux, Windows users - using pipx (recommended)
# See https://pipx.pypa.io/stable/how-to/install-pipx/ to install pipx
pipx install semgrep

# Or, if you use uv (https://docs.astral.sh/uv/)
uv tool install semgrep

# macOS users only - ensure that you've added Homebrew to your PATH
# https://docs.brew.sh/FAQ#my-mac-apps-dont-find-homebrew-utilities
#
# maintained on a best-effort basis; often lags behind the latest release
brew install semgrep

# confirm
semgrep --version
```

--------------------------------

### Install Semgrep CI via pipx

Source: https://docs.semgrep.dev/semgrep-ci/sample-ci-configs

Use this command to install Semgrep CI in environments where Docker is not available or preferred.

```bash
pipx install semgrep
```

--------------------------------

### Sample configuration values

Source: https://docs.semgrep.dev/deployment/local-to-scp-scans

Example of setting environment variables and retrieving necessary metadata for repository linking.

```bash
# Set the repository URL
export SEMGREP_REPO_URL=https://github.com/corporation/s_juiceshop

# Set the repository name
export SEMGREP_REPO_NAME=corporation/s_juiceshop

# Retrieve the branch
git rev-parse --abbrev-ref HEAD
s_update

# Set the branch
export SEMGREP_BRANCH=s_update

# Retrieve the commit hash
git log -n 1
commit fa4e36b9369e5b039bh2220b5h9R61a38b077f29 (HEAD -> s_juiceshop, origin/main, origin/HEAD, master)

# Set the commit hash
export SEMGREP_COMMIT=fa4e36b9369e5b039bh2220b5h9R61a38b077f29
```

--------------------------------

### Example fyi.list File

Source: https://docs.semgrep.dev/contributing/adding-a-language

Configuration file specifying informational files to bundle with the generated parser.

```text
# Comments are allowed on their own line.
# Blank lines are ok.

# Each path is relative to ocaml-tree-sitter-semgrep/lang
semgrep-grammars/src/tree-sitter-ruby/LICENSE
semgrep-grammars/src/tree-sitter-ruby/grammar.js
semgrep-grammars/src/semgrep-ruby/grammar.js
```

--------------------------------

### Locate semgrep-core installation path

Source: https://docs.semgrep.dev/contributing/troubleshooting

Use this command to identify the installation directory of the Semgrep package to find the semgrep-core binary.

```bash
pip3 show semgrep
```

--------------------------------

### Run Expedited Setup Script

Source: https://docs.semgrep.dev/contributing/adding-a-language

Use the add-simple-lang script to quickly set up languages that define a single dialect.

```bash
cd lang
./add-simple-lang --help
```

--------------------------------

### GET /api/agent/deployments/{deploymentId}/github_app_status

Source: https://docs.semgrep.dev/api-reference/v2/deploymentservice/get-deployment-github-app-status

Check if the Semgrep GitHub app is installed for the deployment.

```APIDOC
## GET /api/agent/deployments/{deploymentId}/github_app_status

### Description
Check if the Semgrep GitHub app is installed for the deployment.

### Method
GET

### Endpoint
/api/agent/deployments/{deploymentId}/github_app_status

### Parameters
#### Path Parameters
- **deploymentId** (string) - Required - The unique identifier of the deployment.

#### Query Parameters
- **withCodeAccess** (boolean) - Optional - Whether to check for code access.

### Response
#### Success Response (200)
- **github_app_status** (boolean) - Indicates if the GitHub app is installed.
```

--------------------------------

### Example Pipfile configuration

Source: https://docs.semgrep.dev/kb/semgrep-supply-chain/ssc-python-lockfiles

A sample Pipfile defining package dependencies and Python version requirements.

```text
[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
flasgger = "==0.9.5"
flask = "==2.2.2"
flask-cors = "==3.0.10"
marshmallow = "==3.18.0"
requests = "==2.25.1"
sqlalchemy = "==1.4.41"
waitress = "==2.1.2"
psycopg2 = "==2.9.5"
defusedxml = "==0.7.1"

[dev-packages]

[requires]
python_version = "3.9"
```

--------------------------------

### GET /api/agent/deployments/{deploymentId}/github_app_status

Source: https://docs.semgrep.dev/api-reference/v2/deploymentservice/get-deployment-github-app-status

Check if the Semgrep GitHub app is installed for the specified deployment.

```APIDOC
## GET /api/agent/deployments/{deploymentId}/github_app_status

### Description
Check if the Semgrep GitHub app is installed for the deployment.

### Method
GET

### Endpoint
/api/agent/deployments/{deploymentId}/github_app_status

### Parameters
#### Path Parameters
- **deploymentId** (string) - Required - The unique identifier of the deployment.
```

--------------------------------

### Run semgrep-cli help

Source: https://docs.semgrep.dev/contributing/semgrep-contributing

Verify the CLI installation by displaying the help menu from the cli/ directory.

```bash
pipenv run semgrep --help
```

--------------------------------

### Changelog entry format

Source: https://docs.semgrep.dev/contributing/contributing-code

Examples of the content and naming convention for changelog files.

```text
Fix emojis absorbed by the fleeb generator
```

```text
gh-1234.fixed
   ^^^^ ^^^^^
   |    |
   |    one of: "added", "changed", "fixed", "infra"
   GitHub issue or pull request ID
```

--------------------------------

### Externally managed environment error on Ubuntu

Source: https://docs.semgrep.dev/kb/semgrep-appsec-platform/error-externally-managed-environment

Example of the error message displayed when attempting a system-wide pip installation on Ubuntu.

```bash
error: externally-managed-environment

× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
 python3-xyz, where xyz is the package you are trying to
 install.
    
 If you wish to install a non-Debian-packaged Python package,
 create a virtual environment using python3 -m venv path/to/venv.
 Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make
 sure you have python3-full installed.
    
 If you wish to install a non-Debian packaged Python application,
 it may be easiest to use pipx install xyz, which will manage a
 virtual environment for you. Make sure you have pipx installed.
    
 See /usr/share/doc/python3.12/README.venv for more information.

note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.
```

--------------------------------

### Externally managed environment error on macOS

Source: https://docs.semgrep.dev/kb/semgrep-appsec-platform/error-externally-managed-environment

Example of the error message displayed when attempting a system-wide pip installation on macOS.

```bash
error: externally-managed-environment

× This environment is externally managed
╰─> To install Python packages system-wide, try brew install
 xyz, where xyz is the package you are trying to
 install.
    
 If you wish to install a Python library that isn't in Homebrew,
 use a virtual environment:
    
 python3 -m venv path/to/venv
 source path/to/venv/bin/activate
 python3 -m pip install xyz
    
 If you wish to install a Python application that isn't in Homebrew,
 it may be easiest to use 'pipx install xyz', which will manage a
 virtual environment for you. You can install pipx with
    
 brew install pipx
    
 You may restore the old behavior of pip by passing
 the '--break-system-packages' flag to pip, or by adding
 'break-system-packages = true' to your pip.conf file. The latter
 will permanently disable this error.
    
 If you disable this error, we STRONGLY recommend that you additionally
 pass the '--user' flag to pip, or set 'user = true' in your pip.conf
 file. Failure to do this can result in a broken Homebrew installation.
    
 Read more about this behavior here: <https://peps.python.org/pep-0668/>

note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.
```

--------------------------------

### Enter Python virtual environment

Source: https://docs.semgrep.dev/contributing/semgrep-core-contributing

Navigate to the CLI directory and activate the virtual environment.

```bash
cd cli; pipenv shell # enter the virtual environment
cd ..                # from within the virtual environment, return to the repo root
```

--------------------------------

### Start Semgrep Network Broker

Source: https://docs.semgrep.dev/semgrep-ci/network-broker

Launch the broker container using the specified configuration file.

```bash
sudo docker run -d -it --rm -v $(pwd):/emt ghcr.io/semgrep/semgrep-network-broker:VERSION_NUMBER -c /emt/config.yaml
```

--------------------------------

### Define an HTTP Request Validator

Source: https://docs.semgrep.dev/semgrep-secrets/validators-1

Example configuration for an HTTP GET request validator, including custom headers and host override.

```yaml
request:
  headers:
    Authorization: Bearer $REGEX
    Host: api.semgrep.dev
    User-Agent: Semgrep
  method: GET
  url: https://api.semgrep.dev/user
```

--------------------------------

### GET /api/onboarding/deployments/{deploymentId}/checklist

Source: https://docs.semgrep.dev/api-reference/v2/checklistservice/get-apionboardingdeployments-checklist

Retrieves the onboarding checklist for a specified deployment.

```APIDOC
## GET /api/onboarding/deployments/{deploymentId}/checklist

### Description
Retrieves the onboarding checklist for a specific deployment. This endpoint is currently experimental and subject to change.

### Method
GET

### Endpoint
/api/onboarding/deployments/{deploymentId}/checklist

### Parameters
#### Path Parameters
- **deploymentId** (string) - Required - The unique identifier of the deployment.
```

--------------------------------

### Example of IDOR via URL Parameter Manipulation

Source: https://docs.semgrep.dev/learn/vulnerabilities/idor

Demonstrates how an attacker can access unauthorized files by modifying the filename in a GET request.

```text
GET /findings-report/0xDC0DE-2025-03-18.pdf
```

```text
GET /findings-report/faang-2025-09-17.pdf
```

--------------------------------

### Add package to setup.py

Source: https://docs.semgrep.dev/contributing/semgrep-contributing

Registers the new package in the install_requires list to ensure it is included in the published build.

```text
install_requires = [
       ...
       "pyyaml~=6.0",
    ]
```

--------------------------------

### Document source files

Source: https://docs.semgrep.dev/contributing/contributing-code

Examples of file-level comments explaining the purpose and usage of the code.

```ocaml
(*
   Generate unique names with a given prefix.
*)
```

```ocaml
(*
   Generate unique names with a given prefix. This is used to
   name new grammar rules and new OCaml variables.
*)
```

--------------------------------

### Original Python file for match_based_id example

Source: https://docs.semgrep.dev/semgrep-code/remove-duplicates

The initial state of the file before modifications.

```python
a = 1
b = 2
spcd.get("foo")
c = 3
d = 4
sink("foo")
```

--------------------------------

### Statement Non-Matching Example

Source: https://docs.semgrep.dev/writing-rules/pattern-syntax

Example of a statement that does not match the pattern 'foo'.

```python
import foo
```

--------------------------------

### Creating and Configuring exec.Cmd

Source: https://docs.semgrep.dev/cheat-sheets/go-command-injection

Demonstrates safe and vulnerable ways to initialize the exec.Cmd struct. Avoid using user-controlled input for the Path or Args fields.

```go
package main

import (
  "os/exec"
  "os"
)

func main() {
  cmd := &exec.Cmd {
    // Path is the path of the command to run.
    Path: "/bin/echo",
    // Args holds command line arguments, including the command itself as Args[0].
    Args: []string{ "echo", "hello world" },
    Stdout: os.Stdout,
    Stderr: os.Stdout,
  }
  cmd.Start();
  cmd.Wait();

  // Args can be also omitted and {Path} will be used by default
  cmd := &exec.Cmd {
    Path: "/bin/echo"
  }

  // Vulnerable
  userInput := "/pwn/exploit" // value supplied by user input
  cmd := &exec.Cmd {
    Path: userInput
  }

  // Vulnerable
  userInput1 := "/bin/bash" // value supplied by user input
  userInput2 := []string{ "bash", "exploit.sh" } // value supplied by user input
  cmd := &exec.Cmd {
    Path: userInput1,
    Args: userInput2
  }

}
```

--------------------------------

### Authorization Header Example

Source: https://docs.semgrep.dev/api-reference/findingsservice/list-code-supply-chain-or-ai-powered-scan-findings

Example of the Authorization header required for API requests.

```http
Authorization: Bearer 2991e2fb4b540fe75b8f90677b0b892b6314e4961cb001fe6eb452eee248a628
```

--------------------------------

### Run semgrep-core and semgrep-cli

Source: https://docs.semgrep.dev/contributing/contributing-code

Comparison of output between the core binary and the CLI wrapper.

```text
unsafe-exec.py:1 with rule unsafe-exec
 exec("ls");
```

```text
running 1 rules...
unsafe-exec.py
severity:warning rule:unsafe-exec: Avoid use of exec; it can lead to a remote code execution.
1:exec("ls");
ran 1 rules on 1 files: 1 findings
```

--------------------------------

### GitHub Actions workflow for nonroot Semgrep image

Source: https://docs.semgrep.dev/kb/semgrep-ci/using-nonroot-docker-image-with-gha

This workflow demonstrates how to prepare the environment by copying event data, setting environment variables, adjusting file ownership, and executing the container with the required mounts.

```yaml
name: Semgrep

on:
  # Scan changed files in PRs (diff-aware scanning):
  pull_request: {}
  # Scan on-demand through GitHub Actions interface:
  workflow_dispatch: {}
  # Scan mainline branches if there are changes to .github/workflows/semgrep.yml:
  push:
    branches:
      - main
      - master
    paths:
      - .github/workflows/semgrep.yml
  # Schedule the CI job (this method uses cron syntax):
  schedule:
    - cron: '20 17 * * *' # Sets Semgrep to scan every day at 17:20 UTC.
    # It is recommended to change the schedule to a random time.

jobs:
  semgrep:
    name: semgrep/ci
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Run Semgrep
        run: |

          # Copy the event.json file into the current working directory 
          # so it gets mounted when we run docker and semgrep can refer 
          # to it when setting git metadata.
          cp $GITHUB_EVENT_PATH ./.github_event_path.json
          # Copy over all GitHub Actions related env vars from the runner
          # environment into a file that will get passed into docker so 
          # we retain all necessary env vars that semgrep uses for 
          # setting git metadata.
          echo "Saving these env vars to file, then passing into docker container."
          printenv | sort | egrep "^GITHUB_" | tee .env
          printenv | sort | egrep "^RUNNER_" | tee -a .env
          # Recursively set the owner:group of all files in the current
          # working directory to the UID and GID of the semgrep user
          # that the non-root semgrep docker image runs as. When we bind
          # mount the directory to our docker container, it retains the
          # permissions of the host.
          sudo chown -R 1000:1000 .
          # Finally, we pass in all the env vars from our file along with
          # setting the SEMGREP_APP_TOKEN and updated GITHUB_EVENT_PATH.
          docker run --rm -v "${PWD}:/src" \
            --env-file .env \
            -e SEMGREP_APP_TOKEN=${{ secrets.SEMGREP_APP_TOKEN }} \
            -e GITHUB_EVENT_PATH="/src/.github_event_path.json" \
            semgrep/semgrep:latest-nonroot \
            semgrep ci
```

--------------------------------

### Team Response Schema Example

Source: https://docs.semgrep.dev/api-reference/v2/teamsservice/create-a-deployment-rbac-team

Example values for the team object returned in the response.

```json
{
  "id": "1234",
  "deploymentId": "1111",
  "name": "My Team",
  "slug": "my-team",
  "parentTeamId": "1234",
  "repositoryCount": "1",
  "userCount": "1",
  "childTeamCount": "1",
  "isProjectDefault": false,
  "isUserDefault": false,
  "authorizedScopes": [
    "TEAM_SCOPE_DIRECT_MEMBER",
    "TEAM_SCOPE_MANAGE"
  ]
}
```

--------------------------------

### Ruby Language Directory Hierarchy

Source: https://docs.semgrep.dev/contributing/adding-a-language

Example file structure for a language directory in ocaml-tree-sitter-semgrep.

```bash
lang/ruby               # language name of the form [a-z][a-z0-9]*
├── extensions.txt      # standard name. Required for stats.
├── fyi.list            # list of informational files to copy. Recommended.
├── Makefile -> ../Makefile.common
├── projects.txt        # standard name. Required for stats.
└── test                # sample input files
    ├── ok              # contains input files supported by the current grammar
    │   ├── comment.rb
    │   ├── ex1.rb
    │   ├── ex2.rb
    │   ├── hello.rb
    │   └── poly.rb
    └── xfail            # contains input files that are expected to fail
        └── rating.rb
```

--------------------------------

### Deep Expression Operator Match Example

Source: https://docs.semgrep.dev/writing-rules/pattern-syntax

Example of code that matches the deep expression pattern.

```python
if user.authenticated() and user.is_admin() and user.has_group(gid):
  [ CONDITIONAL BODY ]
```

--------------------------------

### Execute system commands with Process.spawn and Process.exec

Source: https://docs.semgrep.dev/cheat-sheets/ruby-command-injection

Shows how to safely pass arguments to Process methods versus vulnerable string interpolation.

```ruby
# safe
Process.spawn("ls -alh")
Process.spawn("ls", "-alh")
Process.spawn(["ls", "-alh"])

# vulnerable
user_input = ' && cat /etc/passwd' # Value supplied by user
Process.spawn("ls #{user_input}")

# safe
Process.exec("ls -alh")
Process.exec("ls", "-alh")
Process.exec(["ls", "-alh"])

# vulnerable
user_input = ' && cat /etc/passwd' # Value supplied by user
Process.exec("ls #{user_input}")
```

--------------------------------

### Target code for insecure-methods rule

Source: https://docs.semgrep.dev/writing-rules/rule-syntax

Example Python code demonstrating matches and non-matches for the insecure-methods rule.

```python
# ruleid: insecure-methods
module.insecure1("test")
# ruleid: insecure-methods
module.insecure2("test")
# ruleid: insecure-methods
module.insecure3("test")
# ok: insecure-methods
module.secure("test")
```

--------------------------------

### CWE Metadata Examples

Source: https://docs.semgrep.dev/contributing/contributing-to-semgrep-rules-repository

Examples of specifying CWE metadata for SQL Injection and XSS rules.

```yaml
cwe:
  - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
```

```yaml
cwe:
  - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
```

--------------------------------

### List repositories with dependencies in Go

Source: https://docs.semgrep.dev/api-reference/supplychainservice/list-repositories-with-dependencies

Uses the net/http package to send a POST request with a JSON payload.

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/v1/deployments/{deploymentId}/dependencies/repositories"

	payload := strings.NewReader("{\n  \"cursor\": 123,\n  \"dependencyFilter\": {\n    \"includeArchived\": true,\n    \"license\": [\n      \"<string>\"\n    ],\n    \"lockfilePath\": \"<string>\",\n    \"name\": \"<string>\",\n    \"packageFilters\": [\n      {\n        \"exactNameMatch\": true,\n        \"exactVersion\": \"<string>\",\n        \"name\": \"<string>\",\n        \"versionLowerBound\": \"<string>\",\n        \"versionUpperBound\": \"<string>\"\n      }\n    ],\n    \"repositoryId\": [\n      123\n    ],\n    \"version\": \"<string>\"\n  },\n  \"deploymentId\": \"<string>\",\n  \"pageSize\": 5\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}
```

--------------------------------

### Structure directories for rules and targets

Source: https://docs.semgrep.dev/writing-rules/testing-rules

Example directory structure and command for running tests from separate locations.

```sh
$ tree tests

tests
├── rules
│   └── python
│       └── insecure-eval-use.yaml
└── targets
    └── python
        └── insecure-eval-use.py

4 directories, 2 files
```

```sh
semgrep --test --config tests/rules/ tests/targets/
```

--------------------------------

### Install specific Semgrep version with pipx

Source: https://docs.semgrep.dev/kb/semgrep-code/run-specific-version

Use pipx to install or force-reinstall a specific version of Semgrep.

```bash
pipx install semgrep==x.y.z
```

```bash
pipx install --force semgrep==x.y.z
```

--------------------------------

### Match complex logic examples

Source: https://docs.semgrep.dev/writing-rules/rule-syntax

Code snippets that satisfy the nested logical constraints.

```python
def foo(something):
   bar(something)
```

```python
def foo(something):
   baz(something)
```

--------------------------------

### Match insecure function calls

Source: https://docs.semgrep.dev/writing-rules/rule-syntax

Examples of code that match the insecure function call rule.

```python
insecure_func1(something)
insecure_func2(something)
```

```python
insecure_func1(something)
insecure_func2(something_else)
```

--------------------------------

### List Dependencies in Go

Source: https://docs.semgrep.dev/api-reference/supplychainservice/list-dependencies

Uses the standard net/http library to perform a POST request to the dependencies endpoint.

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/v1/deployments/{deploymentId}/dependencies"

	payload := strings.NewReader("{\n  \"cursor\": \"<string>\",\n  \"dependencyFilter\": {\n    \"includeArchived\": true,\n    \"license\": [\n      \"<string>\"\n    ],\n    \"lockfilePath\": \"<string>\",\n    \"name\": \"<string>\",\n    \"packageFilters\": [\n      {\n        \"exactNameMatch\": true,\n        \"exactVersion\": \"<string>\",\n        \"name\": \"<string>\",\n        \"versionLowerBound\": \"<string>\",\n        \"versionUpperBound\": \"<string>\"\n      }\n    ],\n    \"repositoryId\": [\n      123\n    ],\n    \"version\": \"<string>\"\n  },\n  \"deploymentId\": 123,\n  \"pageSize\": 1000\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}
```

--------------------------------

### Authorization Header Example

Source: https://docs.semgrep.dev/api-reference/v2/checklistservice/patch-apionboardingdeployments-checklist

Example of the Authorization header required for API requests using a Bearer token.

```http
Authorization: Bearer 2991e2fb4b540fe75b8f90677b0b892b6314e4961cb001fe6eb452eee248a628
```

--------------------------------

### Apply right-anchored regex

Source: https://docs.semgrep.dev/writing-rules/rule-syntax

A rule configuration using a right-anchored regex to demonstrate how it fails to match the previous examples.

```yaml
rules:
  - id: insecure-methods
    patterns:
      - pattern: module.$METHOD(...)
      - metavariable-regex:
          metavariable: $METHOD
          regex: (insecure$)
    message: module using insecure method call
    languages:
      - python
    severity: HIGH
```

--------------------------------

### Target code for focus-metavariable

Source: https://docs.semgrep.dev/writing-rules/rule-syntax

Example Python code that would be matched by the find-bad-args rule.

```python
def f(x : bad):
    return x
```

--------------------------------

### List repositories with dependencies via PHP

Source: https://docs.semgrep.dev/api-reference/supplychainservice/list-repositories-with-dependencies

Use the cURL extension to execute a POST request.

```php
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/v1/deployments/{deploymentId}/dependencies/repositories",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'cursor' => 123,
    'dependencyFilter' => [
        'includeArchived' => true,
        'license' => [
                '<string>'
        ],
        'lockfilePath' => '<string>',
        'name' => '<string>',
        'packageFilters' => [
                [
                                'exactNameMatch' => true,
                                'exactVersion' => '<string>',
                                'name' => '<string>',
                                'versionLowerBound' => '<string>',
                                'versionUpperBound' => '<string>'
                ]
        ],
        'repositoryId' => [
                123
        ],
        'version' => '<string>'
    ],
    'deploymentId' => '<string>',
    'pageSize' => 5
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}
```

--------------------------------

### Non-matching complex logic example

Source: https://docs.semgrep.dev/writing-rules/rule-syntax

Code that fails the nested logical constraint due to inconsistent metavariable usage.

```python
def foo(something):
   bar(something_else)
```

--------------------------------

### Target code for open redirect rule

Source: https://docs.semgrep.dev/writing-rules/rule-syntax

Example Python code that triggers the open-redirect rule.

```python
from django.http import HttpResponseRedirect
def unsafe(request):
    # ruleid:open-redirect
    return HttpResponseRedirect(request.POST.get("url"))
```

--------------------------------

### Run semgrep-core help

Source: https://docs.semgrep.dev/contributing/semgrep-core-contributing

Verifies the compiled executable by displaying help information.

```bash
_build/default/src/main/Main.exe -help
```

--------------------------------

### Malicious Payload Example

Source: https://docs.semgrep.dev/learn/vulnerabilities/code-injection

An example of a malicious string that exploits the eval() function to execute arbitrary system commands.

```python
__import__('os').system('whoami')
```

--------------------------------

### Project directory structure example

Source: https://docs.semgrep.dev/docs/semgrep-supply-chain/set-up-and-configure

Visual representation of how Semgrep Supply Chain associates code files with manifest and lockfiles based on directory depth.

```text
/my-project
├───/running
│   ├───lockfile.json
│   ├───bar.js
│   └───/uphill
│       ├───lockfile.json
│       └────foo.js
├───/biking
```

--------------------------------

### Target code for TLS rule

Source: https://docs.semgrep.dev/writing-rules/rule-syntax

Example JavaScript code that triggers the disallow-old-tls-versions2 rule.

```python
function bad() {
    // ruleid:disallow-old-tls-versions2
    var constants = require('crypto');
    var sslOptions = {
    key: fs.readFileSync('/etc/ssl/private/private.key'),
    secureProtocol: 'SSLv23_server_method',
    secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3
    };
    https.createServer(sslOptions);
}
```

--------------------------------

### Define a custom entry point with environment variables

Source: https://docs.semgrep.dev/kb/integrations/customize-semgrep-precommit

Use a shell command as the entry point to set environment variables like SEMGREP_RULES before executing the scan.

```bash
 entry: sh -c 'env SEMGREP_RULES=<SEMGREP_RULESET_URL> semgrep scan --code --no-suppress-errors --baseline-commit HEAD'
```

--------------------------------

### Target code for JavaScript inside HTML rule

Source: https://docs.semgrep.dev/writing-rules/rule-syntax

Example HTML/JS code that triggers the test rule.

```python
{/* ruleid:test */}
<script>
console.log("hello")
</script>
```

--------------------------------

### Accepting logging configuration with logging.config.listen()

Source: https://docs.semgrep.dev/cheat-sheets/python-code-injection

Demonstrates a server listening for configurations and a client sending a malicious configuration that triggers code execution via eval().

```python
# Server example: starting up a socket server on 9999 port, and listening for new configurations.
import logging
import logging.config

logging.config.fileConfig('logging.conf')
t = logging.config.listen(9999)
t.start()


# Client example: sending configuration from `data_to_send` variable to localhost:9999
import socket, sys, struct

# Config example: print("pwned") is evaluated and "pwned" is printed to the console
data_to_send = """
[loggers]
keys=root

[handlers]
keys=hand01

[formatters]
keys=form01

[logger_root]
level=NOTSET
handlers=hand01

[handler_hand01]
class=StreamHandler
level=NOTSET
formatter=form01
args=(print("pwned"),)

[formatter_form01]
format=F1 %(asctime)s %(levelname)s %(message)s
datefmt=
class=logging.Formatter
"""

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('localhost', 9999))
s.send(struct.pack('>L', len(data_to_send)))
s.send(data_to_send)
s.close()
```

--------------------------------

### Initialize submodules

Source: https://docs.semgrep.dev/contributing/semgrep-core-contributing

Use this command if the repository was cloned without submodules.

```bash
git submodule update --init --recursive
```

--------------------------------

### Integrate Semgrep in Jenkins via Installation

Source: https://docs.semgrep.dev/deployment/add-semgrep-to-other-ci-providers

Installs Semgrep directly in the Jenkins environment using pipx before executing the scan.

```java
pipeline {
    agent any
    environment {
      // You need to set the token as an environment variable
      // (see Create a `SEMGREP_APP_TOKEN` section).
      SEMGREP_APP_TOKEN = credentials('SEMGREP_APP_TOKEN')
    }
    stages {
      stage('Semgrep-Scan') {
        steps {
          // Install and run Semgrep:
          sh 'pipx install semgrep'
          sh 'semgrep ci'
        }
      }
    }
  }
```

--------------------------------

### Parameterizing Command Arguments

Source: https://docs.semgrep.dev/cheat-sheets/go-command-injection

Shows the recommended approach of using parameterization for command arguments versus the vulnerable practice of concatenating user input into a shell command string.

```go
cmd := &exec.Cmd {
    Path: "/path/to/myCommand",
    Args: []string{ "myCommand", "myArg1", inputValue },
  }
```

```go
cmd := &exec.Cmd {
    Path: "/bin/bash",
    Args: []string{ "bash", "-c", "myCommand myArg1 " + inputValue },
  }
```

--------------------------------

### C Typed Metavariable Pattern and Example

Source: https://docs.semgrep.dev/writing-rules/pattern-syntax

Pattern for matching comparisons against char arrays and a corresponding C code example.

```text
pattern: $X == $Y
```

```text
pattern: $X == (char *$Y)
```

```c
int main() {
    char *a = "Hello";
    int b = 1;

    // Matched
    if (a == "world") {
        return 1;
    }

    // Not matched
    if (b == 2) {
        return -1;
    }

    return 0;
}
```

--------------------------------

### Build semgrep-core

Source: https://docs.semgrep.dev/contributing/semgrep-core-contributing

Compile the semgrep-core binary.

```bash
make core
```

--------------------------------

### Python Taint Source and Sink Example

Source: https://docs.semgrep.dev/writing-rules/data-flow/taint-mode/advanced

A basic Python example demonstrating a variable being sanitized by a side-effect function before reaching a sink.

```python
x = source()
check_if_safe(x)
sink(x)
```

--------------------------------

### Example of an ignored placeholder secret

Source: https://docs.semgrep.dev/kb/semgrep-secrets/no-example-secrets-found

This Python assignment is ignored by Semgrep Secrets because it contains the 'EXAMPLE' string, which indicates a placeholder value.

```python
AWS_SECRET_ACCESS_KEY = "AKIA000EXAMPLE83A0I4"
```
Tokens:
Raw