3rd Virtual Chapter meeting - Detect complex code patterns using semantic grep

Title: Detect complex code patterns using semantic grep

Abstract:
We’ll discuss a program analysis tool we’re developing called Semgrep. It's a multilingual semantic tool for writing security and correctness queries on source code (for Python, Java, Go, C, and JS) with a simple “grep-like” interface. The original author, Yoann Padioleau, worked on Semgrep’s predecessor, Coccinelle, for Linux kernel refactoring, and later developed Semgrep while at Facebook. He’s now full time with us at r2c.

Semgrep is a free open-source program analysis toolkit that finds bugs using custom analysis we’ve written and OSS code checks. Semgrep is ideal for security researchers, product security engineers, and developers who want to find complex code patterns without extensive knowledge of ASTs or advanced program analysis concepts.

For example, find subprocess calls with shell=True in Python using the query:
subprocess.open(..., shell=True)
This will even find snippets like:
import subprocess as s
s.open(f'rm {args}', shell=True)

Or find hardcoded credentials using the query:
boto3.client(..., aws_secret_access_key=”...”, aws_access_key_id=”...” )

Source code: https://github.com/returntocorp/semgrep
Test in your browser: https://semgrep.live/

Speaker bio:
Luke O’Malley is the co-founder of r2c, a company profoundly improving software security and reliability. As its Head of Product he works with the world’s leading developers to improve their build tooling and development practices. Previously he led developer tools teams at Palantir, wrote software to support counter-terrorism efforts, and researched propulsion systems for deep-space exploration. Luke is an angel investor in the dev tools and security space. He received his BS degree in Electrical Engineering and Computer Science from MIT. His other interests include bee keeping, adventure motorcycling, and typography.