登录

semgrep-rules

0xdeaMIT活跃维护

一套面向漏洞研究的 Semgrep 规则集，覆盖 C 等语言的静态代码扫描，帮你在审计时快速定位可疑模式。

A collection of my Semgrep rules to facilitate vulnerability research.

v2.0.0发布于 2026-06-15 07:30 UTC882star90fork同步于 2026-11-10 17:55 UTC
静态分析漏洞挖掘代码审计Semgrep规则
对比 GitHub 官网code-reviewsemgrepsemgrep-rulesstatic-analysisvulnerability-research

怎么上手

由 README 提炼，执行前请确认
原文 
semgrep --severity ERROR --severity WARNING --config "p/0xdea"
硬件要求按 README 说明

README 未说明

下载：源码 zip·GitHub Releases（安装包）本站不镜像安装包

项目说明

由 README 自动翻译提炼
没人工点评？写下你的经验

一套面向 C/C++ 漏洞研究的 Semgrep 规则集，覆盖缓冲区溢出、整数溢出、内存管理等常见缺陷

一套面向漏洞研究的 Semgrep 规则集，覆盖 C 等语言的静态代码扫描，帮你在审计时快速定位可疑模式。

核心能力

  • 按缓冲区溢出、整数溢出、格式化字符串等类别组织 C/C++ 规则
  • 检测 gets、strcpy、sprintf 等不安全 API 调用
  • 识别 use-after-free、double-free 等内存管理问题
  • 支持按严重级别过滤扫描，可只跑 ERROR 级快速筛查
  • 输出 SARIF 格式，可配合 VS Code 插件查看结果

容易踩的坑

需先自行安装 Semgrep CLI，README 测试版本为 1.169.0；默认会遵循 .gitignore 跳过文件，需加 --no-git-ignore 才能全量扫描；noisy 目录下的规则误报较多，不建议直接用于常规扫描

内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README

最近发版

4 个版本v2.0.0
全部 release
  1. v2.0.0v2.0.0 - Current stable release最新正式版2026-06-15 · 2026-06-15 07:30 UTC

    First release to be published in the official Semgrep registry.

    Changed

    • Add the deep expression operator in some patterns (incorrect-order-setuid-setgid, regex-dos).
    • Optimize memory allocation patterns (mismatched-memory-management, mismatched-memory-management-cpp, unchecked-ret-malloc).
    • Remove trailing semicolon from some detection patterns (incorrect-use-of-memset, mismatched-memory-management, mismatched-memory-management-cpp, putenv-stack-var, unsafe-strlen).
    • Change language in bad-words from generic to regex to improve performance.
    • Refactor the directory tree to simplify integration with the official Semgrep registry.
    • Add link to the official Semgrep registry to the documentation.
    • Generally improve code samples and documentation.

    Security

    • Pin all action references to hashes and add zizmor GitHub workflow.
  2. v1.2.02026-04-03 · 2026-04-03 16:33 UTC
    查看更新说明

    Added

    • Add C++ this and function call patterns to incorrect-use-of-sizeof.
    • Add detections for confstr, ttyname_r/ptsname_r, strfind/strrspn/strtrns, readlinkat, fgetws/fgetws_l, *cftime, chdir, chroot, copylist, dbminit, fattach, ftw, truncate, umask/ulimit, cdev_init, inet_*, utmp*, OemToCharW, mbs/wcs, *spawn*, CreateProcess*, and missing get* family functions (interesting-api-calls).
    • Add detections for some Microsoft-specific functions (interesting-api-calls).
    • Add detections for missing str* family functions (insecure-api-strcpy-strcat, interesting-api-calls, overlapping-source-destination, write-into-stack-buffer).
    • Add detections for mempcpy and wmempcpy (use-of-source-size-in-copy, interesting-api-calls, overlapping-source-destination, signed-unsigned-conversion, write-into-stack-buffer).
    • Add detections for swprintf and vswprintf (signed-insigned-conversion, write-into-stack-buffer).
    • Add detection for p2open and wordexp (command-injection, interesting-api-calls).
    • Add detections for faccessat, faccessat2, and fstatat (insecure-api-access-stat, interesting-api-calls).
    • Add detections for rand48 family functions (insecure-api-rand-srand, interesting-api-calls).
    • Add detections for syslog and err/warn function families (memory-address-exposure).
    • Add detections for missing signal family functions (insecure-api-signal, interesting-api-calls).
    • Add detection for tmpnam_r (insecure-api-mktemp-tmpnam-tempnam, interesting-api-calls).
    • Add detection for VirtualAlloc (integer-wraparound).
    • Add detection for syscall (interesting-api-calls).
    • Add some code samples (command-injection, format-string-bugs, incorrect-use-of-sizeof, insecure-api-access-stat, insecure-api-gets, insecure-api-scanf, insecure-api-sprintf-vsprintf, interesting-api-calls, off-by-one, unsafe-ret-snprintf-vsnprintf, use-after-free, use-of-source-size-in-copy, unterminated-string-strncpy).
    • Add required metadata to contribute rules to the Semgrep Registry.
    • Add metadata validation in GitHub workflow (see also ToB's CONTRIBUTING document).
    • Add prettier-check GitHub action to check YAML formatting.

    Changed

    • Extend *s*printf pattern matching (interesting-api-calls).
    • Improve matching of array creation patterns (incorrect-use-of-free, putenv-stack-var, ret-stack-address, write-into-stack-buffer).
    • Improve matching of array creation and length calculation (off-by-one).
    • Optimize uses of the deep expression operator (unchecked-ret-malloc, use-after-free).
    • Exclude string literals as source (insecure-api-scanf).
    • Add detections for snprintf family functions and improve pattern matching (use-of-source-size-in-copy).
    • Replace the pattern = $_; with = ...; everywhere.
    • Rename incorrect-order-setuid-setgid-etc into incorrect-order-setuid-setgid.
    • Rename incorrect-use-of-strncpy-memcpy-etc into use-of-source-size-in-copy.
    • Rename insecure-api-scanf-etc into insecure-api-scanf.
    • Rename unchecked-ret-scanf-etc into unchecked-ret-scanf.
    • Rename insecure-api-strcpy-stpcpy-strcat into insecure-api-strcpy-strcat.
    • Rename unterminated-string-strncpy-stpncpy into unterminated-string-strncpy.
    • Rename unchecked-ret-malloc-calloc-realloc into unchecked-ret-malloc.
    • Rename insecure-api-access-stat-lstat into insecure-api-access-stat.
    • Rename insecure-api-atoi-atol-atof into insecure-api-ato.
    • Rename overlapping-src-dst into overlapping-source-destination.
    • Rearrange rule order based on new subcategory/likelihood/impact metrics.
    • Improve code samples, documentation, and indent style.
    • Update SARIF output example.
  3. v1.1.02025-12-03 · 2025-12-03 14:47 UTC
    查看更新说明

    Added

    • Add high-entropy-assignment and regex-dos rules that use the new metavariable-analysis feature.
    • Add detections for the __iso99_*scanf function family (format-string-bugs, insecure-api-scanf, unchecked-ret-scanf).
    • Add detections for the _mb* and *_s/*_l function families (insecure-api-strcpy-stpcpy-strcat, interesting-api-calls, unsafe-ret-strlcpy-strlcat, unsafe-strlen, unterminated-string-strncpy-stpncpy, write-into-stack-buffer).
    • Add some code samples (incorrect-use-of-strncpy-memcpy-etc, integer-wraparound, overlapping-src-dst).
    • Add SARIF output example as requested.
    • Add GitHub action to automate rule validation and testing.

    Changed

    • Rename incorrect-use-of-strncpy-stpncpy-strlcpy into incorrect-use-of-strncpy-memcpy and add matching of memcpy and its main variants.
    • Rename incorrect-use-of-sprintf-snprintf into overlapping-src-dst and add matching of other copy functions.
    • Exclude length known at compile time from memcpy matches (interesting-api-calls).
    • Explicitly exclude $_ = 0 assignments to reduce false positives (integer-truncation, signed-unsigned-conversion).
    • Refactor some rules to include other variants and improve readability and scalability (unsafe-ret-snprintf-vsnprintf, unsafe-ret-strlcpy-strlcat, unsafe-strlen).
    • Implement case-insensitive matching (interesting-api-calls).
    • Reduce false positives (format-string-bugs, putenv-stack-var, ret-stack-address, unsafe-ret-snprintf-vsnprintf, write-into-stack-buffer).
    • Use the new anonymous metavariables feature where suitable.
    • Optimize some patterns (integer-truncation, integer-wraparound, mismatched-memory-management, mismatched-memory-management-cpp, off-by-one, write-into-stack-buffer, missing-return).
    • Change some confidence levels (integer-truncation, integer-wraparound, putenv-stack-var, ret-stack-address).
    • Move rules into a dedicated folder.
    • Improve documentation and code formatting.

    Removed

    • Remove non-existent API functions (insecure-api-strcpy-stpcpy-strcat, unterminated-string-strncpy-stpncpy).
  4. v1.0.0v1.0.0 - Historical stable release2025-11-10 · 2025-11-10 08:12 UTC
    查看更新说明

    Historical, battle-tested stable release.

用户点评

登录用户的真实使用记录，可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译
    在 GitHub 打开

    semgrep-rules

    validate

    "The attack surface is the vulnerability. Finding a bug there is just a detail."

    -- Mark Dowd

    "Some details are more important than others."

    -- Fedor G. Pikus

    A collection of my Semgrep rules to facilitate vulnerability research.

    Program in C

    Articles

    See also

    Setup and usage instructions

    1. Install Semgrep.
    2. To use these rules via the Semgrep registry, run the following from the root folder of your target source code repository:
    # high priority scan (quick wins)
semgrep --severity ERROR --config "p/0xdea"

# high and medium priority scan (recommended)
semgrep --severity ERROR --severity WARNING --config "p/0xdea"

# full scan (might include marginal findings and more false positives)
semgrep --config "p/0xdea"

    Alternatively, you can clone this GitHub repository locally and run:

    # full scan
semgrep --config semgrep-rules/rules /path/to/source

# specific rule scan
semgrep --config semgrep-rules/rules/c/command-injection.yaml /path/to/source

    [!TIP] Specify the --no-git-ignore switch to scan files regardless of git tracking status or .gitignore rules.

    For a better streamlined experience, I recommend saving the Semgrep scan output in SARIF format and using SARIF Explorer in VS code:

    semgrep --sarif --sarif-output=/path/to/source/SEMGREP.sarif --config semgrep-rules/rules /path/to/source
code /path/to/source # then open the SEMGREP.sarif file in VS code with SARIF Explorer

    See also the included SARIF output example.

    Compatibility

    Tested with Semgrep CLI 1.169.0.

    Rules

    C/C++

    Battle-tested C (and sometimes C++) ruleset.

    buffer overflows
    integer overflows
    format strings
    memory management
    command injection
    race conditions
    privilege management
    denial of service
    • regex-dos. Regular expression that may exhibit exponential runtime and lead to ReDoS.
    miscellaneous

    Noisy

    These rules are considered potentially too noisy and unsuitable for general use.

    generic
    • bad-words. Keywords and comments that suggest the presence of bugs.

    Changelog

    TODO

    Short-term action items

    • Process open issues and pull requests.
    • Add new checks to the existing rules and add new rules where needed.
    • Improve overall accuracy and reduce false positives, without missing potential hot spots in code.
    • Check performance (see test_public_repos.py).
    • Additional --time benchmarking against real-world code to spot slow rules in need of optimization.

    Long-term action items

    • Add scripts to clean up pseudocode generated by common decompilers to improve Semgrep parsing.
    • Port the rules to the Semgrep Pro engine, which allows for inter-file and inter-function analysis.
    • Implement taint mode where suitable to improve rules with dataflow analysis.
    • Investigate symbolic propagation that might be useful to reduce some false positives.
    • Implement a Semgrep wrapper and post-processor as described in this research.

    Domain-specific rulesets

    • Implement dedicated kernel rules (Linux, BSD, macOS, etc.).
    • Implement dedicated crypto and rng rules.
    • Implement dedicated C++ rules and move them in another folder separated from the one for C rules.
    • Create a specific ruleset for Rust.

    相关项目

    同分类里 star 最高的项目
    对比全部 →
    ruff
    astral-sh·Rust

    用 Rust 写成的超快 Python 代码检查与格式化工具，能替代 Flake8、Black 等，大幅缩短 lint 和格式化耗时。

    Python 代码检查+4代码质量
    51157+3882.6k0.17.42026-11-10 17:02 UTC
    open-code-review
    alibaba·Go

    阿里开源的大规模代码审查工具，用确定性流水线加 LLM Agent 混合架构，精准定位行级问题，内置 NPE、线程安全、XSS、SQL 注入等多语言规则集。

    代码审查+4代码质量
    49782+1673.7kv1.13.62026-11-10 11:15 UTC
    SwiftLint
    realm·Swift

    Swift 代码风格检查工具，按预设规则自动扫描并报告不符合规范的写法，帮团队统一 Swift 代码风格。

    Swift+4代码质量
    19786+52.3k0.65.12026-11-05 17:57 UTC
    diff-so-fancy
    so-fancy·Perl

    把 Git diff 输出重新排版成更易读的格式，突出改动位置和代码块，方便快速定位缺陷、提升代码审查效率。

    代码审查+3代码质量
    18114+4350v1.4.142026-10-18 18:29 UTC