Semgrep SAST: Writing Custom Rules and Integrating Static Analysis in CI

# Match any call to exec with any arguments
rules:
  - id: exec-call
    pattern: exec(...)
    message: "Avoid exec() calls"
    languages: [python]
    severity: WARNING

# Match subprocess.call with shell=True
rules:
  - id: subprocess-shell-true
    pattern: subprocess.call(..., shell=True, ...)
    message: "subprocess.call with shell=True is vulnerable to command injection"
    languages: [python]
    severity: ERROR

rules:
  - id: sql-injection-python
    patterns:
      - pattern: |
          cursor.execute($QUERY, ...)
      - pattern-not: |
          cursor.execute("...", ...)
      - pattern-not: |
          cursor.execute($QUERY, ($VALUE, ...))
    message: >
      Possible SQL injection: cursor.execute called with a non-literal
      query string and no parameterized values. Use parameterized queries.
    languages: [python]
    severity: ERROR
    metadata:
      cwe: "CWE-89"
      owasp: "A03:2021 - Injection"

rules:
  - id: unique-rule-id          # kebab-case, unique within your ruleset
    pattern: ...                # or patterns:/pattern-either:/etc.
    message: "Description"      # shown to developers, explain the risk and fix
    languages: [javascript]     # language(s) this rule applies to
    severity: ERROR             # ERROR, WARNING, or INFO

    metadata:
      cwe: "CWE-79"
      confidence: HIGH
      likelihood: MEDIUM
      impact: HIGH
      subcategory: vuln         # vuln, audit, or best-practice
    fix: |
      sanitize($INPUT)          # automated fix pattern (experimental)

rules:
  - id: hardcoded-jwt-secret
    pattern-either:
      - pattern: jwt.sign($PAYLOAD, "...")
      - pattern: jwt.verify($TOKEN, "...")
      - pattern: |
          const $SECRET = "...";
          ...
          jwt.sign($PAYLOAD, $SECRET)
    pattern-not:
      - pattern: jwt.sign($PAYLOAD, process.env.$VAR)
      - pattern: jwt.sign($PAYLOAD, $CONFIG.$KEY)
    message: >
      JWT secret appears to be hardcoded. Use an environment variable:
      jwt.sign(payload, process.env.JWT_SECRET)
    languages: [javascript, typescript]
    severity: ERROR
    metadata:
      cwe: "CWE-798"

rules:
  - id: eval-with-user-input
    patterns:
      - pattern: eval($EXPR)
      - pattern-not: eval("...")
      - pattern-inside: |
          function $FUNC(..., $REQ, ...) {
            ...
          }
    message: >
      eval() called inside a request handler with a non-literal argument.
      This is a critical code injection vulnerability.
    languages: [javascript]
    severity: ERROR
    metadata:
      cwe: "CWE-95"
      owasp: "A03:2021 - Injection"

rules:
  - id: express-xss-response
    patterns:
      - pattern: res.send($OUTPUT)
      - metavariable-pattern:
          metavariable: $OUTPUT
          patterns:
            - pattern: req.$FIELD
            - pattern-not: sanitizeHtml(...)
    message: >
      Potential XSS: user input from req.$FIELD sent directly to res.send()
      without sanitization.
    languages: [javascript]
    severity: ERROR

# Run OWASP Top 10 ruleset
semgrep -c p/owasp-top-ten .

<span class="hljs-comment"># Run JavaScript security rules
semgrep -c p/javascript .

<span class="hljs-comment"># Run Python security rules
semgrep -c p/python .

<span class="hljs-comment"># Run multiple rulesets
semgrep -c p/owasp-top-ten -c p/nodejs -c p/secrets .

<span class="hljs-comment"># Run specific rules by ID
semgrep -c r/javascript.express.security.express-puppeteer-injection .

# tests/test_sql_injection.py

import sqlite3
conn = sqlite3.connect("test.db")
cursor = conn.cursor()

# ruleid: sql-injection-python
cursor.execute("SELECT * FROM users WHERE id = " + user_id)

# ruleid: sql-injection-python
query = f"SELECT * FROM users WHERE name = '{username}'"
cursor.execute(query)

# ok: sql-injection-python (parameterized — should NOT match)
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

# ok: sql-injection-python (literal string — should NOT match)
cursor.execute("SELECT * FROM users")

semgrep --test rules/ tests/

Testing rules against test fixtures...
rules/sql-injection.yaml: 2 ✓, 0 ✗
All tests passed.

name: Semgrep SAST

on:
  pull_request: {}
  push:
    branches: [main]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    permissions:
      security-events: write
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Run Semgrep with community + custom rules
        run: |
          semgrep \
            --config p/owasp-top-ten \
            --config p/secrets \
            --config ./semgrep-rules/ \
            --sarif \
            --output semgrep.sarif \
            --error \
            --exclude "node_modules,dist,build,*.test.js,*.spec.js" \
            .

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: semgrep.sarif

// nosemgrep: hardcoded-jwt-secret
const TEST_SECRET = "test-secret-for-unit-tests-only";

# Save current findings as baseline
semgrep --config p/owasp-top-ten . --json > .semgrep-baseline.json

<span class="hljs-comment"># In CI: fail only on findings not in the baseline
semgrep --config p/owasp-top-ten . --baseline-commit HEAD~1 --error