Enhancing Shell Script Security with Semgrep: A Simple Guide

Original Post: Scanning Shell Scripts With Semgrep

Semgrep has introduced experimental support for Bash scripting to help catch common shell syntax errors and unsafe command usages. Highlights include:

1. Detecting Forbidden Commands: Options to flag the usage of blacklisted commands.

2. Variable Splitting:

   • Addresses misunderstandings around variable expansion, especially related to the IFS variable that determines string separators.
   • Provides examples and solutions for handling IFS safely and checking for unquoted variables that may cause splitting.

3. Iterating over ls Output: Implements rules like ShellCheck’s SC2045 to detect improper iterations.

4. Bash Parsing Status:

   • Current parsing success rate is around 92%.
   • Supported constructs include simple commands, pipelines, various loops, function definitions, assignments, and simple/double-quoted variable expansions.
   • Semgrep patterns supported: ellipsis, metavariables, deep ellipsis.
5. Limitations:
   • Doesn’t yet match file redirections, background jobs, or scripts with unconventional extensions.
   • Lacks understanding of certain command syntaxes and array accesses.
   • Arithmetic expressions and C-style loops are not yet supported.

Overall, while the feature is still evolving, it aims to provide essential functionality to improve the robustness and safety of shell scripts.

Go here to read the Original Post