Semgrep tool test

[PhilipD8]

• Testing out a tool for identifying security vulnerabilities.
• Not included in starter tools list.
  Tool integration can be seen in .semgrep.yml
  Artifacts of successful tool run can be seen in semgrep-output.txt and semgrep-results.json

Pros

• Lightweight integration

• Easy to save results with a small addition to package.json:
  "scripts": { "semgrep": "semgrep scan --config auto" }

• Has flexible outputs (supports JSON as well), making it convenient for future CI/CD use

• Before running, you have flexible priori customization settings on what to ignore (for example: ".semgrepignore"

Cons

• Needs to be continuously customized to control what outputs are being given (might be too noisy)
• Installation is a bit complicated

[PhilipD8]

• The tool being used is Semgrep. This tool identifies security vulnerabilities, code smells, and repeated patterns of bugs in code. Link to documentation.
• Semgrep is a static analysis tool
• Semgrep catches security vulnerabilities (like risks of code injections, etc.), unsafe hardcoded sensitive data, incorrect use of language features, as well as other general code quality issues.
• Custom rules can be defined in ".semgrep.yml", specific files can be ignored when compiling in ".semgrepignore", and the output format can be changed as well.
• Semgrep can be integrated locally using npm scripts either before you start to code, or right before to you merge to check for code issues.
• Most flagged issues for the pattern-based code detection are technically valid, but they often aren't relevant, so technically, the false positive rate is quite low. Additionally, the pattern-based code detection might miss certain patterns not covered by the rules. The default configurations flag a lot of irrelevant issues, meaning there is a moderate amount of true positives that we don't care about.