Comparing JavaScript Static Analysis Tools: ESLint vs Semgrep

Original Post: JavaScript static analysis comparison: ESLint vs Semgrep

GitLab recently decided to transition its SAST analyzers to Semgrep, phasing out Bandit and ESLint. This post compares Semgrep and ESLint in terms of security coverage, custom rules, performance, and CI/CD usage.

Key Comparisons:

1. Security Coverage: ESLint offers 261 JavaScript rules, while Semgrep, with access to a community-maintained registry, has over 1,000 rules for various languages, including 404 for JavaScript. Semgrep can hold rulesets like p/eslint-plugin-security and p/gitlab-eslint for focused coverage.

2. Custom Rules: ESLint custom rules are written in JavaScript and require a plugin setup, while Semgrep uses YAML files with easy-to-understand syntax to write patterns. Both tools provide thorough documentation for creating custom rules.

3. Performance: ESLint is significantly faster than Semgrep, especially on larger repositories. Semgrep’s performance improves with multithreading but still lags behind ESLint on vast codebases.

4. Usage in CI/CD: Both tools can be integrated with CI systems and pre-commit hooks. ESLint has extensive plugin support across various text editors and IDEs, while Semgrep offers integrations for VS Code, IntelliJ IDEA, and vim. For CI/CD, both tools can be used in build systems, but Semgrep provides more configuration options in its officially supported actions.

Additional Insights:

• False Positives: Semgrep tends to have more false positives than ESLint, but offers flexible rules and quick adjustments.
• Rule Testing: Both tools support rule testing, with ESLint using the Mocha framework and Semgrep utilizing simple inline annotations.
• Ignoring Code: Both tools support ignoring specific rules on lines of code or entire files with respective configuration files (.eslintignore and .semgrepignore).

Conclusion:

While ESLint provides faster performance and potentially fewer false positives for JavaScript, Semgrep stands out for its multi-language support, easy rule customization, and extensive CI/CD integrations. This makes Semgrep a versatile tool despite its slower performance.

Go here to read the Original Post