Original Post: Improving ReDoS detection and finding more bugs using Dlint and r2c This post is part of a series discussing ReDoS (Regular Expression Denial of Service) vulnerabilities. It begins by guiding users to install… Read More »Enhancing ReDoS Detection and Uncovering Additional Bugs with Dlint and r2c
Original Post: Silicon Valley Cyber Security: Detect complex code patterns using semantic grep The Silicon Valley Cyber Security Meetup hosted a virtual event, “Talkin’ Security,” on April 9th, where a presentation about “semgrep” was given.… Read More »Enhance Security in Silicon Valley: Mastering Complex Code Detection with Semantic Grep
Original Post: Semgrep at Hella Secure HellaConf 2020 Thanks to Hella Secure for hosting the virtual AppSec conference, HellaConf 2020. At the event, r2c’s CTO, Drew, gave a presentation on Semgrep, an open-source code analysis… Read More »Highlights from Semgrep’s Presentation at HellaConf 2020
Original Post: Preventing SQL injection: a Django author's perspective This guest post, co-authored by Jacob Kaplan-Moss (Django co-creator) and Grayson Hardaway, explains SQL Injection (SQLi) and its dangers, while offering prevention strategies, particularly for Django… Read More »Mastering SQL Injection Prevention: Insights from a Django Developer
Original Post: Pain-free custom linting: why I moved from ESLint and Bandit to Semgrep tldr: Semgrep is an easy-to-learn and prototype analysis tool that supports multiple languages. Summary: The author describes their experience with various… Read More »Pain-Free Custom Linting with Semgrep: Why I Switched from ESLint and Bandit
Original Post: Semgrep: Stop grepping code Summary: Semgrep is an open-source, code-aware grep tool that allows users to easily match function calls, function arguments regardless of order, or sequences of function calls (e.g., A() after… Read More »Semgrep: The Modern Tool for Code Analysis Beyond Grep
Original Post: Be careful what you request for HTTP Verbs HTTP supports custom verbs beyond the standard GET and POST, as outlined in RFC2616, Section 9. This flexibility can lead to vulnerabilities if not handled… Read More »The Unexpected Consequences of Getting What You Wish For
Original Post: Hardcoded secrets, unverified tokens, and other common JWT mistakes This article explains the common security mistakes developers make when using JSON Web Tokens (JWT) in Node.js projects. JWT is a standard for securely… Read More »Common JWT Pitfalls: Hardcoded Secrets, Unverified Tokens, and More
Original Post: How to prevent HTML email injection in Python web apps tl;dr: HTML Injection Vulnerability: When user input is rendered as HTML in emails, it can lead to phishing attacks. Attackers can exploit vulnerabilities… Read More »Top Techniques for Securing Against HTML Email Injection in Python Web Apps
Original Post: Type-awareness in semantic grep Semgrep, an open source static analysis tool by r2c, now supports specifying types in code patterns, allowing for more precise detection of bugs, antipatterns, and best practice enforcement. In… Read More »Enhancing Search Precision: Understanding Type-Aware Semantic Grep