Martin Jambon on Semgrep (2021-04-21)

Semgrep is an open-source syntax-aware grep, which is used to scan source code for insecure patterns such as ‘exec(…)’. It allows the user to specify patterns in the same language as the target, with only the addition of a few constructs such as ‘…’ and ‘$FOO’. We will cover basic usage before diving into the design and the OCaml implementation. In particular, I will present:
1. challenges of parsing and analyzing many programming languages,
2. the generic mode, which handles unsupported languages