Original Post: Developer-focused results and improved coverage with Semgrep Pro rules
The content highlights the launch and features of Semgrep Code, an advanced code security product from Semgrep that combines the new Semgrep Pro Engine with professional-grade rules for actionable security findings.
Background
- The open-source community has contributed over 2500 rules to the Semgrep Registry, but high coverage and confidence are crucial for robust SAST programs.
- Semgrep Code, recently announced, aims to provide developers with accurate security findings through its new Semgrep Pro Engine and Pro rules.
Getting Started with Pro Rules
- Semgrep Pro rules are proprietary, created by the r2c Security Research team, emphasizing improved coverage and high confidence for developers.
- These rules are available to those with access to Semgrep Code’s Team Tier and can be added to your Rule Board from the Semgrep Registry, identified by a diamond icon.
Motivation for Pro Rules
- Community rules often cast a wide net for potential vulnerabilities, suitable for security auditors but less actionable for developers.
- Pro rules focus on high confidence results to provide developers with accurate findings and minimize false positives.
Developer-Focused High-Confidence Rules
- High confidence rules use Semgrep features like taint tracking analysis to identify actual security issues.
- The goal is to convert research into accurate rules covering various languages and vulnerabilities, reducing triage workloads and enhancing CI/CD pipelines.
Available Pro Rules
- Current Semgrep Pro rules address various vulnerabilities:
- Hard-coded Secrets: 110 rules across multiple languages.
- XXE: Detection and mitigation in Java.
- Deserialization: Nearly 70 rules focusing on Python and Java.
- Injection Attacks: Coverage for SQLi, XSS, and more across several languages.
- DOM-based XSS: For frameworks like Angular, React, and Next.js.
- Framework Support: Extensive for technologies like Java Servlets, Spring, ExpressJs, Laravel, and Go net/http.
For more detailed updates and getting started, users are encouraged to check the Rule updates and the documentation. For further assistance, users can contact Semgrep.
Go here to read the Original Post