forked from pixee/codemodder-python
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsemgrep.py
More file actions
123 lines (105 loc) · 4.25 KB
/
semgrep.py
File metadata and controls
123 lines (105 loc) · 4.25 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
import itertools
import json
import subprocess
from pathlib import Path
from tempfile import NamedTemporaryFile
from typing import Iterable, Optional
from typing_extensions import Self, override
from codemodder.context import CodemodExecutionContext
from codemodder.logging import logger
from codemodder.result import LineInfo, Result, ResultSet, SarifLocation, SarifResult
from codemodder.sarifs import AbstractSarifToolDetector
class SemgrepSarifToolDetector(AbstractSarifToolDetector):
@classmethod
def detect(cls, run_data: dict) -> bool:
return (
"tool" in run_data
and "semgrep" in run_data["tool"]["driver"]["name"].lower()
)
class SemgrepLocation(SarifLocation):
@classmethod
def from_sarif(cls, sarif_location) -> Self:
artifact_location = sarif_location["physicalLocation"]["artifactLocation"]
file = Path(artifact_location["uri"])
start = LineInfo(
line=sarif_location["physicalLocation"]["region"]["startLine"],
column=sarif_location["physicalLocation"]["region"]["startColumn"],
snippet=sarif_location["physicalLocation"]["region"]["snippet"]["text"],
)
end = LineInfo(
line=sarif_location["physicalLocation"]["region"]["endLine"],
column=sarif_location["physicalLocation"]["region"]["endColumn"],
snippet=sarif_location["physicalLocation"]["region"]["snippet"]["text"],
)
return cls(file=file, start=start, end=end)
class SemgrepResult(SarifResult):
location_type = SemgrepLocation
class SemgrepResultSet(ResultSet):
@classmethod
def from_sarif(cls, sarif_file: str | Path, truncate_rule_id: bool = False) -> Self:
with open(sarif_file, "r", encoding="utf-8") as f:
data = json.load(f)
result_set = cls()
for sarif_run in data["runs"]:
for result in sarif_run["results"]:
sarif_result = SemgrepResult.from_sarif(
result, sarif_run, truncate_rule_id
)
result_set.add_result(sarif_result)
return result_set
class InternalSemgrepResultSet(SemgrepResultSet):
@override
def results_for_rule_and_file(
self, context: CodemodExecutionContext, rule_id: str, file: Path
) -> list[Result]:
del context
paths_for_rule = self.get(rule_id, {})
# Do not normalize the path
return paths_for_rule.get(file, [])
def run(
execution_context: CodemodExecutionContext,
yaml_files: Iterable[Path],
files_to_analyze: Optional[Iterable[Path]] = None,
) -> SemgrepResultSet:
"""
Runs Semgrep and outputs a dict with the results organized by rule_id.
"""
if not yaml_files:
raise ValueError("No Semgrep rules were provided")
with NamedTemporaryFile(prefix="semgrep", suffix=".sarif") as temp_sarif_file:
command = [
"semgrep",
"scan",
"--no-error",
"--dataflow-traces",
"--sarif",
"-o",
temp_sarif_file.name,
]
command.extend(
itertools.chain.from_iterable(
map(lambda f: ["--config", str(f)], yaml_files)
)
)
command.extend(map(str, files_to_analyze or [execution_context.directory]))
logger.debug("semgrep command: `%s`", " ".join(command))
call = subprocess.run(
command,
shell=False,
check=False,
stdout=None if execution_context.verbose else subprocess.PIPE,
stderr=None if execution_context.verbose else subprocess.PIPE,
)
if call.returncode != 0:
if not execution_context.verbose:
logger.error("captured semgrep stderr: %s", call.stderr)
try:
logger.error("semgrep sarif output: %s", temp_sarif_file.read())
except Exception as e:
logger.error("failed to read semgrep sarif output: %s", e)
raise subprocess.CalledProcessError(call.returncode, command)
# semgrep prepends the folders into the rule-id, we want the base name only
results = InternalSemgrepResultSet.from_sarif(
temp_sarif_file.name, truncate_rule_id=True
)
return results