1
Scaling Your Security Program
with Semgrep
Ambitious Claim
In this workshop you will:
2
A friendly ask 🙏
Please send me example code patterns you want to find!
We can write a rule live together ✊
3
whois?
4
r2c:�We’re an SF based static analysis startup on a mission to profoundly improve software security and reliability.
Tl;dr sec Newsletter - https://tldrsec.com
Talk summaries | Tools & Resources links | Original research
5
Outline
6
Outline
7
Nerd Snipe! Surprise Semgrep Challenge
https://semgrep.dev/s/clintgibler:flask-route-no-admin-annotation-try
The first person to tweet a semgrep.live Playground solution link to @clintgibler wins a Semgrep t-shirt and some stickers
8
Outline
9
Eradicating Vulnerability Classes
by Shelving SAST & Embracing Secure Defaults & Invariants
Clint Gibler
head of security research, r2c
Isaac Evans
ceo, r2c
Finding Bugs Only using the “safe” way
Detecting (lack of) use of
secure defaults
is much easier than
finding bugs
12
A Pragmatic Approach for Internal Security Partnerships
AppSec Cali ‘19, Scott Behrens, Esha Kanekar
13
How Valuable Can Banning Functions Be?
41% of vulnerability reduction from XP → Vista from banning strcpy and friends
Analysis of 63 buffer-related security bugs that affect Windows XP, Windows Server 2003 or Windows 2000 but not Windows Vista: 82% removed through SDL process
14
Google:
15
Building Secure and Reliable Systems, by Google
Facebook:
"We invest heavily in building frameworks that help engineers prevent and remove entire classes of bugs when writing code."
16
Designing Security For Billions by Facebook
Anecdote - a hyper growth Bay Area start-up
“We were concerned about RCE in our NodeJS applications, so we banned eval() and new Function()...”
Wrote custom ESlint plugins that ran on every PR that banned 👆
...never had to worry about these types of issues in NodeJS apps
“You can get amazing security wins if you can be a bit draconian about coding standards.”
(Caveat: of course this requires engineering buy-in, the security team must support company goals)
17
Dev Akhawe: PhD UC Berkeley, Dir of Security Eng Dropbox, Head of Sec Figma
“Historically, heavyweight, slow static analysis tools focused on finding vulnerabilities. This approach is fundamentally not the right path for scaling security in modern development. Security teams today need tools that are fast, customizable to our codebases, can easily be added to any part of the SDLC, and are effective at enforcing secure coding patterns to prevent vulnerabilities.��As security engineering teams define best practices, they need a scalable, low-noise mechanism to detect unsafe practices and point developers toward safe coding mechanisms. These practices are often specific to the company.
18
Outline
19
OODA Loop (Observe, Orient, Decide, Act)
AppSec: Faster iteration cycles fundamentally alter how we work and think
“This is too much work, why bother.”
👀------------------------------🧠-------------------------------👍------------------------------💪
“I want to keep this from happening again. <1st attempt> <2nd> OK great roll out everywhere.”
👀--🧠--👍--💪 👀--🧠--👍--💪 👀--🧠--👍--💪 👀--🧠--👍--💪 👀--🧠--👍--💪
20
Outline
21
Dev Akhawe: PhD UC Berkeley, Dir of Security Eng Dropbox, Head of Sec Figma
...
Working with static analysis tools today is no longer a purely operational workflow, it’s a creative venture where a security engineer is building something new on top of the analysis engine.”
22
Static Analysis as Bug Finding Fundamental Capability
How to get your security tooling/services adopted? Provide capabilities your colleagues want
Non-security benefits of static analysis:
23
Outline
24
Company-specific Checks are Often the Most Valuable
Common trend I see across a number of companies
“We had a P1 auth bypass bug bounty submission. I wrote a quick rule to find other instances of it, and found a P0 an hour later.”
25
Outline
26
Choosing a Static Analysis Tool
27
Rolling Out Static Analysis
Offline
Full scan of every repo - current state of the world
What vulnerability classes are most prevalent?
Make a game plan
Goal: solve classes of bugs
Continuous in CI
Roll out a few, high signal checks (stem the bleeding)
Consider choosing a vulnerability class to focus on
Pen Tests / Bug Bounty -> custom rules
Goal: Raise your org’s security bar, one inch at a time
28
Outline
29
30
Why Semgrep is 🔥 for Security Consultants / Researchers
31
Why Semgrep is 😍 for AppSec Engineers & Developers
Coding Standards ➡️ Enforce Continuously
32
Use Cases
How can the security team provide valuable capabilities to their developer customers?
33
34
Semgrep
Our Worldview�
35
Design Decisions�
Given:
Semgrep:
36
��
Semgrep Ecosystem
How the Parts Fit Together
37
How Semgrep Works
38
Abstract Syntax Trees (ASTs)
Findings
(security bugs)
Pattern Matcher
Security Checks
Parser
+
Source Code
Semgrep Agent
39
Semgrep Agent
Semgrep
Popular SAST Vendors
40
| Fortify, Checkmarx | CodeQL | Semgrep |
Open source rules | ❌ | ✅ | ✅ |
Open source engine | ❌ | ❌ | ✅ |
Freely test on closed source repos | ❌ | ❌ | ✅ |
Open source SaaS app | ❌ | ❌ | ❌ |
Semgrep Cloud
41
Semgrep Agent
Semgrep
Semgrep Agent
Semgrep
Semgrep Agent
Semgrep
Why Semgrep Cloud?
Value
Vs. Other SAST offerings
Vs. Rolling Your Own
42
VS Code Extension!
43
Integrating into CI
https://semgrep.dev/docs/integrations/#continuous-integration-ci
But any CI pipeline where you can run an CLI tool (--json) or a Docker image will work ✅
44
Community rule registry
45
Outline
46
GitHub Learning Lab: Intro to Semgrep
https://lab.github.com/returntocorp/intro-to-semgrep
47
Finding Banned, Deprecated, or Dangerous Functions
⇒ https://semgrep.dev/s/clintgibler:python-exec-try
Full Solution: https://semgrep.dev/s/clintgibler:python-exec
48
Semgrep Cheat Sheet
49
#1 Code equivalence (semantic grep)
50
$X == $X
foo(kwd1=1,kwd2=2,...)
subprocess.open(...)
import foo.bar
Will match
(a+b != a+b) # <=> !(a+b==a+b)
foo(kwd2=2, kwd1=1, kwd3=3)
from subprocess import open as
sub_open
result = sub_open(“ls”)
from foo import bar
Will match
Will match
Will match
#2: ‘...’ ellipsis operator
‘…’ can match sequences of:
51
foo(...,5)
foo(“...”)
$V = get()
...
eval($V)
Will match
foo(1,2,3,4,5)
foo(5)
foo(“whatever sequence of chars”)
user_data = get()
print(“do stuff”)
foobar()
eval(user_data)
Will match
Will match
#3 Metavariables (part 1)
52
foo($X,2)
if $E:
foo()
if $X > $Y:
$S
$F(1,2)
Will match
foo(1,2)
if x > 2:
foo()
if var > 2:
return 1
foo(1,2)
Will match
Will match
Will match
#3 Metavariables (part 2)
You can reuse the same metavariable: semgrep enforces equality constraint
53
$X == $X
if $E:
$S
else:
$S
$V = open()
close($V)
Will match
if (a+b == a+b):
if x > 2:
foo()
bar()
else:
foo()
bar()
myfile = open()
close(myfile)
Will match
Will match
Rule Syntax
54
Relevant Links
55
Outline
56
----fast mode 🚀
Recent optimizations built-in to Semgrep, enabled now by default��Works by quickly reviewing source code contents, and then failing early if a pattern couldn’t possibly match
Shoutout to Yoann, Emma, & others 👉
57
Commutative Matching - Find A and B
58
metavariable-pattern
59
metavariable-pattern
60
}
}
metavariable-pattern
61
}
}
}
Metavariable-pattern - Scan Polyglot Files 💪
Applications: JS in HTML, template files, React/VueJS, infra as code, Dockerfiles
64
Outline
65
Combining Semgrep with Regex - pattern-regex
66
Weak RSA Key - Scriptable! pattern-where-python
67
* requires non-default flag: --dangerously-allow-arbitrary-code-execution-from-rules
Typed Patterns - Find calls to exec() on Runtime objects
68
JSON
69
Find <script> tags w/out SRI (“Generic” mode)
70
Terraform: Public read/write buckets (“Generic” mode)
71
Try it: https://semgrep.dev/s/clintgibler:terraform-public-read-write-try
Solution: https://semgrep.dev/s/clintgibler:terraform-public-read-write
Pattern:
?
72
Exercise! Find calls to exec() in Ruby
https://semgrep.dev/s/clintgibler:ruby-exec-demo-try
73
Exercise! Find TLS config with insecure settings
74
Find arbitrary file read in Flask
⇒ https://semgrep.dev/s/clintgibler:python-flask-sendfile-try
Full Solution: https://semgrep.dev/s/clintgibler:python-flask-sendfile
75
Exercise! Find XSS in ExpressJS
76
Order of API Calls Must be Enforced
77
Exercise! If you call someFunc(), you need to call it at least twice
78
Outline
79
Autofix!
80