From e6132eca0c970b612e652fc03e94c2d4b598aee4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Lajeunesse-Robert?= Date: Fri, 4 Jul 2025 16:03:34 -0400 Subject: [PATCH 1/7] Improve semgrep prescan checks and ease semgrep rules extension --- scanners/boostsecurityio/semgrep/module.yaml | 25 +++----- .../boostsecurityio/semgrep/prescan_checks.sh | 60 +++++++++++++++++++ 2 files changed, 69 insertions(+), 16 deletions(-) create mode 100755 scanners/boostsecurityio/semgrep/prescan_checks.sh diff --git a/scanners/boostsecurityio/semgrep/module.yaml b/scanners/boostsecurityio/semgrep/module.yaml index afe514c7..de89098c 100644 --- a/scanners/boostsecurityio/semgrep/module.yaml +++ b/scanners/boostsecurityio/semgrep/module.yaml @@ -12,29 +12,22 @@ config: - .semgrep/* setup: - - name: Validate rules - environment: - SEMGREP_RULES: ${SEMGREP_RULES:-https://assets.build.boostsecurity.io/semgrep-rules/stable/all-sast-rules.yml} + - name: Utility scripts run: | - echo "SEMGREP_RULES set to: '$SEMGREP_RULES'" - for rule in $SEMGREP_RULES; do - case "$rule" in - .semgrep/*|http://*|https://*) - # valid rule token; do nothing - ;; - *) - echo "Semgrep Community Rules cannot be used. Provide a URL or relative path to rules file or leave blank for Boost curated rules." - exit 1 - ;; - esac - done + mkdir -p $SETUP_PATH/pre-scan-checks/ + cp $SETUP_PATH/../../registry/scanners/boostsecurityio/semgrep/prescan_checks.sh $SETUP_PATH/pre-scan-checks/semgrep steps: + - run: | + $SETUP_PATH/pre-scan-checks/semgrep + environment: + SEMGREP_RULES: ${SEMGREP_RULES:-boost/sast/rules/semgrep@stable} - scan: command: docker: image: returntocorp/semgrep:1.114.0@sha256:0cd75960cfec2215ff734a4f6379bbbb6edb82de0c24593dd0a70ec65e9860a9 - command: semgrep scan --oss-only --sarif --quiet --disable-version-check --metrics=off . + command: | + semgrep scan --config ./.semgrep --oss-only --sarif --quiet --disable-version-check --metrics=off . workdir: /src environment: XDG_CONFIG_HOME: /tmp diff --git a/scanners/boostsecurityio/semgrep/prescan_checks.sh b/scanners/boostsecurityio/semgrep/prescan_checks.sh new file mode 100755 index 00000000..d9165b36 --- /dev/null +++ b/scanners/boostsecurityio/semgrep/prescan_checks.sh @@ -0,0 +1,60 @@ +#!/bin/bash +local_rules_dst=$(mktemp -d) +if [ -d ".semgrep" ] +then + mv .semgrep/ "$local_rules_dst" +fi +mkdir -p .semgrep + +fetch_remote() { + file_name="${1##*/}" + file_extension="${file_name##*.}" + if [ "$file_extension" != "yaml" ] && [ "$file_extension" != "yml" ] + then + >&2 echo "Semgrep custom rules validation failed." + >&2 echo " The provided URL do not point to a yaml file: $1." + rm -rf $local_rules_dst + exit 1 + fi + + dst_file=$(mktemp --suffix=.yml) + http_code=$(curl -s -L --fail -w '%{http_code}\n' -o $dst_file $1) + if [ "${http_code}" == "200" ] + then + cp $dst_file .semgrep/ + rm -f $dst_file + return 0 + fi + + >&2 echo "Semgrep custom rules - Cannot fetch $1." + rm -f $dst_file + rm -rf $local_rules_dst + exit 1 +} + +SEMGREP_RULES=${SEMGREP_RULES:-boost/sast/rules/semgrep@stable} +for rule in $SEMGREP_RULES; do + case "$rule" in + .semgrep/*) + # Local rules are allowed + cp -R $local_rules_dst/.semgrep/* .semgrep || true + ;; + http://*|https://*) + fetch_remote $rule + ;; + boost/sast/rules/semgrep@*) + # Boost + version=$(echo "$rule" | cut -d '@' -f 2) + fetch_remote "https://assets.build.boostsecurity.io/semgrep-rules/$version/all-sast-rules.yml" + ;; + *) + >&2 echo "Semgrep custom rules validation failed on $rule." + >&2 echo " Community rules cannot be used." + >&2 echo " Provide a URL or relative path to rules file or leave blank for Boost curated rules." + rm -rf $local_rules_dst + exit 1 + ;; + esac +done + +rm -rf $local_rules_dst \ No newline at end of file From 32e3f23e754ab030d9cf690c75197896c934a9db Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Lajeunesse-Robert?= Date: Fri, 4 Jul 2025 16:12:02 -0400 Subject: [PATCH 2/7] Stripping querystring and hash tag from URL --- scanners/boostsecurityio/semgrep/prescan_checks.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scanners/boostsecurityio/semgrep/prescan_checks.sh b/scanners/boostsecurityio/semgrep/prescan_checks.sh index d9165b36..7861eb74 100755 --- a/scanners/boostsecurityio/semgrep/prescan_checks.sh +++ b/scanners/boostsecurityio/semgrep/prescan_checks.sh @@ -8,6 +8,7 @@ mkdir -p .semgrep fetch_remote() { file_name="${1##*/}" + file_name=$(echo $file_name | cut -d '#' -f 1 | cut -d '?' -f 1) file_extension="${file_name##*.}" if [ "$file_extension" != "yaml" ] && [ "$file_extension" != "yml" ] then From 9ce16bbc57cf00be2be34acaac804bd51214f3e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Lajeunesse-Robert?= Date: Fri, 4 Jul 2025 16:16:17 -0400 Subject: [PATCH 3/7] Force overwrite --- scanners/boostsecurityio/semgrep/prescan_checks.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/boostsecurityio/semgrep/prescan_checks.sh b/scanners/boostsecurityio/semgrep/prescan_checks.sh index 7861eb74..089dc042 100755 --- a/scanners/boostsecurityio/semgrep/prescan_checks.sh +++ b/scanners/boostsecurityio/semgrep/prescan_checks.sh @@ -38,7 +38,7 @@ for rule in $SEMGREP_RULES; do case "$rule" in .semgrep/*) # Local rules are allowed - cp -R $local_rules_dst/.semgrep/* .semgrep || true + cp -R -f $local_rules_dst/.semgrep/* .semgrep || true ;; http://*|https://*) fetch_remote $rule From 492d3de50a6490b7dc501a68b8134b285ec5a33f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Lajeunesse-Robert?= Date: Fri, 4 Jul 2025 16:39:24 -0400 Subject: [PATCH 4/7] Improved local configurations checks --- .../boostsecurityio/semgrep/prescan_checks.sh | 22 +++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/scanners/boostsecurityio/semgrep/prescan_checks.sh b/scanners/boostsecurityio/semgrep/prescan_checks.sh index 089dc042..cd7cf075 100755 --- a/scanners/boostsecurityio/semgrep/prescan_checks.sh +++ b/scanners/boostsecurityio/semgrep/prescan_checks.sh @@ -38,7 +38,18 @@ for rule in $SEMGREP_RULES; do case "$rule" in .semgrep/*) # Local rules are allowed - cp -R -f $local_rules_dst/.semgrep/* .semgrep || true + if [ "$rule" == ".semgrep/*" ] + then + # + cp -R -f $local_rules_dst/.semgrep/* .semgrep || true + else + if [ ! -f "$local_rules_dst/$rule" ] && [ ! -d "$local_rules_dst/$rule" ] + then + >&2 echo "Semgrep custom rules validation failed." + >&2 echo " The specific file or directory does not exist in the code repository: $rule." + fi + cp -R -f "$local_rules_dst/$rule" .semgrep || true + fi ;; http://*|https://*) fetch_remote $rule @@ -46,6 +57,7 @@ for rule in $SEMGREP_RULES; do boost/sast/rules/semgrep@*) # Boost version=$(echo "$rule" | cut -d '@' -f 2) + # $version is not sanitized since one can provide any URL in the boost config fetch_remote "https://assets.build.boostsecurity.io/semgrep-rules/$version/all-sast-rules.yml" ;; *) @@ -58,4 +70,10 @@ for rule in $SEMGREP_RULES; do esac done -rm -rf $local_rules_dst \ No newline at end of file +rm -rf $local_rules_dst + +if [ "$(find .semgrep -regex '.*\.ya?ml' | wc -l)" == "0" ] +then + >&2 echo "Semgrep custom rules validation failed for $SEMGREP_RULES." + >&2 echo " Missing yaml configuration files" +fi \ No newline at end of file From 8ebbb02f66b970421809d14656592f5fdb4b1c6d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Lajeunesse-Robert?= Date: Mon, 7 Jul 2025 11:09:23 -0400 Subject: [PATCH 5/7] Existing on no yaml file --- scanners/boostsecurityio/semgrep/prescan_checks.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scanners/boostsecurityio/semgrep/prescan_checks.sh b/scanners/boostsecurityio/semgrep/prescan_checks.sh index cd7cf075..2ec81bc1 100755 --- a/scanners/boostsecurityio/semgrep/prescan_checks.sh +++ b/scanners/boostsecurityio/semgrep/prescan_checks.sh @@ -76,4 +76,5 @@ if [ "$(find .semgrep -regex '.*\.ya?ml' | wc -l)" == "0" ] then >&2 echo "Semgrep custom rules validation failed for $SEMGREP_RULES." >&2 echo " Missing yaml configuration files" + exit 1 fi \ No newline at end of file From 1296dc23f1a07d4fa6caa94bffa3d22f5d094086 Mon Sep 17 00:00:00 2001 From: Franck-Boost Date: Mon, 7 Jul 2025 14:56:19 -0400 Subject: [PATCH 6/7] Update scanners/boostsecurityio/semgrep/prescan_checks.sh Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Franck-Boost --- scanners/boostsecurityio/semgrep/prescan_checks.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/boostsecurityio/semgrep/prescan_checks.sh b/scanners/boostsecurityio/semgrep/prescan_checks.sh index 2ec81bc1..07292bde 100755 --- a/scanners/boostsecurityio/semgrep/prescan_checks.sh +++ b/scanners/boostsecurityio/semgrep/prescan_checks.sh @@ -13,7 +13,7 @@ fetch_remote() { if [ "$file_extension" != "yaml" ] && [ "$file_extension" != "yml" ] then >&2 echo "Semgrep custom rules validation failed." - >&2 echo " The provided URL do not point to a yaml file: $1." + >&2 echo " The provided URL does not point to a YAML file: $1." rm -rf $local_rules_dst exit 1 fi From b40190953943d3a594379203271543c5baf7226b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Lajeunesse-Robert?= Date: Mon, 7 Jul 2025 15:01:48 -0400 Subject: [PATCH 7/7] Exiting on inexisting local rule --- scanners/boostsecurityio/semgrep/prescan_checks.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scanners/boostsecurityio/semgrep/prescan_checks.sh b/scanners/boostsecurityio/semgrep/prescan_checks.sh index 07292bde..f057b56e 100755 --- a/scanners/boostsecurityio/semgrep/prescan_checks.sh +++ b/scanners/boostsecurityio/semgrep/prescan_checks.sh @@ -47,6 +47,7 @@ for rule in $SEMGREP_RULES; do then >&2 echo "Semgrep custom rules validation failed." >&2 echo " The specific file or directory does not exist in the code repository: $rule." + exit 1 fi cp -R -f "$local_rules_dst/$rule" .semgrep || true fi