semgrep-rules - A collection of my Semgrep rules to facilitate vul

项目说明

semgrep-rules

![]()
![]()
![]()
![]()
![]()
![]()
![]()

> "The attack surface is the . Finding a bug there is just a detail."
>
> -- Mark Dowd

> "Some details are more important than others."
>
> -- Fedor G. Pikus

A collection of my Semgrep rules to facilitate research.

![Program in C]()

Articles

* <
* <
* <
* <
* <

See also

* <
* <
* <

Setup and usage instructions

1. Install Semgrep.
2. To use these rules via the Semgrep registry, run the following from the root folder of your target source code repository:

Alternatively, you can clone this GitHub repository locally and run:

> [!TIP]
> Specify the --no-git-ignore switch to scan files regardless of git tracking status or .gitignore rules.

For a better streamlined experience, I recommend saving the Semgrep scan output in SARIF format and using SARIF Explorer in VS code:

See also the included SARIF output example.

Compatibility

Tested with Semgrep CLI 1.169.0.

Rules

C/C++

Battle-tested C (and sometimes C++) ruleset.

#### buffer o

* insecure-api-gets. Use of the insecure API function gets.
* insecure-api-strcpy-strcat. Use of potentially insecure API functions strcpy, stpcpy, strcat.
* insecure-api-sprintf-. Use of potentially insecure API functions sprintf and .
* insecure-api-scanf. Use of potentially insecure API functions in the scanf family.
* incorrect-use-of-strncat. Wrong size argument passed to strncat.
* use-of-source-size-in-copy. Wrong size argument passed to strncpy, memcpy, snprintf, and .
* incorrect-use-of-sizeof. Accidental use of the sizeof operator on a pointer instead of its target.
* unterminated-string-strncpy. Lack of explicit NUL-termination after strncpy and stpncpy.
* off-by-one. Potential off-by-one error.
* unsafe-ret-snprintf-. Potentially unsafe use of the return value of snprintf and .
* unsafe-ret-strlcpy-strlcat. Potentially unsafe use of the return value of strlcpy and strlcat.
* pointer-subtraction. Potential use of pointer subtraction to determine size.
* write-into-stack-buffer. Direct write into buffer allocated on the stack.

#### integer o

* integer-wraparound. Potential integer wraparound errors.
* unsafe-strlen. Casting the return value of strlen to short might be dangerous.
* integer-truncation. Potential integer truncation errors.
* signed-unsigned-con. Potential signed/unsigned con errors.
* incorrect-unsigned-comparison. Checking if an unsigned is negative.

#### format strings

* format-string-bugs. Potential format string bugs.

#### memory management

* insecure-api-alloca. Use of the potentially insecure API function alloca.
* use-after-free. Potential use after free.
* double-free. Potential double free.
* incorrect-use-of-free. Calling free on memory not in the heap.
* unchecked-ret-malloc. Unchecked return code of malloc, calloc, realloc, etc.
* puten. Call to putenv with a stack-allocated .
* ret-stack-address. Potential return of the address of a stack-allocated .
* mismatched-memory-management. Potentially mismatched C memory management routines.
* mismatched-memory-management-cpp. Potentially mismatched C++ memory management routines.
* memory-address-exposure. Potential exposure of underlying memory addresses.

#### command injection

* command-injection. Potential OS command injection via system or popen.

#### race conditions

* insecure-api-access-stat. Use of insecure API functions access, stat, lstat, etc.
* insecure-api-mktemp-tmpnam-tempnam. Use of insecure API functions mktemp, tmpnam, tempnam.
* insecure-api-signal. Use of insecure API function signal.

#### pri management

* incorrect-order-setuid-setgid. Pri management functions called in the wrong order.
* unchecked-ret-setuid-seteuid. Unchecked return code of setuid and seteuid.

#### denial of service

* regex-dos. Regular expression that may exhibit exponential runtime and lead to ReDoS.

#### miscellaneous

* incorrect-use-of-memset. Wrong order of arguments to memset.
* insecure-api-rand-srand. Use of potentially insecure API functions rand and srand.
* oation. Source and destination o in copy functions.
* suspicious-assert. Potentially invalid size check due to use of assertion macros.
* interesting-api-calls. Calls to interesting and potentially insecure API functions.
* unchecked-ret-scanf. Unchecked return code of functions in the scanf family.
* insecure-api-ato. Use of potentially insecure API functions atoi, atol, atof.
* high-entropy-assignment. Assignment of a high-entropy value that might be a secret.
* arg. Command-line argument or en access.
* missing-default-in-switch. Missing default case in a switch statement.
* missing-break-in-switch. Missing break or equi in a switch statement.
* missing-return. Missing return statement in non-void function.
* typos. Potential typos with security implications.

Noisy

These rules are considered potentially too noisy and unsuitable for general use.

#### generic

* bad-words. Keywords and comments that suggest the presence of bugs.

Changelog

* CHANGELOG.md

TODO

Short-term action items

* Process open issues and pull requests.
* Add new checks to the existing rules and add new rules where needed.
* Impro accuracy and reduce false positives, without missing potential hot spots in code.
* Check performance (see test_public_repos.py).
* Additional --time benchmarking against real-world code to spot slow rules in need of optimization.

Long-term action items

* Add scripts to clean up pseudocode generated by common decompilers to impro parsing.
* Port the rules to the Semgrep Pro engine, which allows for inter-file and inter-function analysis.
* Implement taint mode where suitable to impro with dataflow analysis.
* In symbolic propagation that might be useful to reduce some false positives.
* Implement a Semgrep wrapper and post-processor as described in this research.

Domain-specific rulesets

* Implement dedicated kernel rules (Linux, BSD, macOS, etc.).
* Implement dedicated crypto and rng rules.
* Implement dedicated C++ rules and move them in another folder separated from the one for C rules.
* Create a specific ruleset for Rust.

项目信息

开发语言：C

Star 数：875

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of my Semgrep rules to facilitate vulnerability research.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。