Hacker News Reader

Comment by jhgb | Hacker News Reader

Isn't "grep for code" called just "grep"?

Semgrep started off as a “syntactic grep” but has increasingly become more semantic. So if you want to find all calls to foo that have 1 as the first argument, you just search for foo(1) and even things like x = 1; foo(x); will match.

Here’s an elaborate example: https://semgrep.dev/s/ievans:c-dataflow

Ok, I've put the word 'semantic' up there so we can not get hung up on title stuff. (Submitted title said "Like Grep but for Code".)

That's called "a code walker", isn't it?

It does seem potentially good for enforcing standards where the participants are willing. But you can work around it fairly easily. Like the example "python no-prints" rule: https://semgrep.dev/s/sabihb:no-prints

Lots of workarounds it wouldn't find, like:

  import builtins
  builtins.print("whee")

I'm guessing the value with the rules system is, you can add new rules easily. So during a code review, if you see somebody using your example, you could create a new rule to catch that.

I don't think you can go in with the mindset that it will catch everything, but rather, it's about being able to iterate quickly with your rules.

Sure. I raised it because it keeps using the word "static analysis", which at least wouldn't be fooled by builtins.print(). It's more than grep, for sure, but something less than static analysis tools I've used. And I don't mean that as a knock. It's working across a lot of languages, so I see the tradeoff.

Tagline appears to be submitter's, not the project's.

ievans works for r2c

Reply on news.ycombinator.com