Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
This report summarizes scanner evidence for semgrep/semgrep, a C project with 16,960 GitHub stars. SynthScan examined 774,013 lines of code across 5891 source files, recording 2719 pattern matches distributed across 27 syntactic categories. The legacy adjusted pattern signal is 4.6 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 2099 finding(s).
Are imports declared and package/API names verified? 322 finding(s).
Are wrappers, guards, and repeated structures necessary? 1224 finding(s).
Which changes need focused human review? 2719 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2719 distinct pattern matches across 27 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-config.yaml | 1 | # coupling: if you add a check in this file, please add it first in | COMMENT |
| LOW | .pre-commit-config.yaml | 161 | - repo: https://github.com/google/go-jsonnet | COMMENT |
| LOW | .pre-commit-config.yaml | 241 | # do nothing because the target files are passed | COMMENT |
| LOW | .pre-commit-config.yaml | 261 | # it runs on all the files in a repo). In that case I | COMMENT |
| LOW | .pre-commit-hooks.yaml | 1 | # See https://pre-commit.com/#new-hooks for more information on this file. | COMMENT |
| LOW | semgrep.yml | 1 | # This file contains Semgrep rules. See https://semgrep.dev for more info. | COMMENT |
| LOW | mypy-tests.ini | 1 | # TODO: explain why we have a different mypy setup for test code. | COMMENT |
| LOW | setup.py | 1 | # | COMMENT |
| LOW | tests/patterns/go/partial_single_field2.go | 1 | package main | COMMENT |
| LOW | tests/patterns/go/misc_ref_new.go | 21 | //body, err := io.ReadAll(res.Body) | COMMENT |
| LOW | …sts/patterns/python/const_fold_edge_floor_div_large.py | 1 | # Floor division with dividends >= 2^62 must fold to the correct result. | COMMENT |
| LOW | tests/patterns/python/python2.py | 1 | #ERROR: match | COMMENT |
| LOW | tests/patterns/python/import_metavar_fullpath.py | 1 | # what actually matters in this test is the value bound to $X | COMMENT |
| LOW | tests/patterns/python/cp_label.py | 1 | # This is not actually valid Python. Python does not allow comments after line | COMMENT |
| LOW | tests/patterns/python/misc_fake_propa.py | 1 | # This used to generate a FakeTokStr exn when we introduced the | COMMENT |
| LOW | tests/patterns/js/infer_const_regexp.js | 1 | // Constant propagation should work with regexp literals just like string | COMMENT |
| LOW | tests/patterns/dart/dart_import_package_collision.dart | 1 | // Verifies the Naming_utils.unsafe_canonicals guard in Naming_AST: two | COMMENT |
| LOW | tests/patterns/rust/attribute_matching.rs | 41 | // MATCH: | COMMENT |
| LOW | tests/patterns/rust/misc_naming_recursion.rs | 1 | // this was causing -dump_named_ast to recurse indefinitely | COMMENT |
| LOW | tests/patterns/java/metavar_typed_bool.java | 41 | COMMENT | |
| LOW | tests/patterns/json/metavar_array.json | 1 | // Note that this file is not really a valid JSON file because | COMMENT |
| LOW | tests/patterns/cpp/preprocessor_elif.cpp | 1 | #if FIRST | COMMENT |
| LOW | …erns/cpp/parsing_todo_tree_sitter/non_recoverable1.cpp | 21 | #include "tensorflow/core/framework/tensor_util.h" | COMMENT |
| LOW | …erns/cpp/parsing_todo_tree_sitter/non_recoverable1.cpp | 261 | unit_dimension++; | COMMENT |
| LOW | …erns/cpp/parsing_todo_tree_sitter/non_recoverable1.cpp | 281 | // | COMMENT |
| LOW | tests/patterns/csharp/todo/misc_linq.cs | 1 | // this used to not match because of bad interaction with -fast | COMMENT |
| LOW | tests/patterns/ruby/metavar_interpolated.rb | 1 | # https://github.com/returntocorp/semgrep/issues/3560 | COMMENT |
| LOW | tests/autofix/python/metavar_string2.py | 1 | # Forked from metavar_string.py to comment out the f string below but test | COMMENT |
| LOW | tests/autofix/ts/fix_cast.ts | 1 | // Regression test for https://github.com/returntocorp/semgrep/issues/6233. The | COMMENT |
| LOW | tests/rules_v2/const_fold_overflow.py | 1 | # Regression tests for 64-bit integer overflow detection in constant folding. | COMMENT |
| LOW | tests/rules_error_recovery/lines_of_file_outofbound.tf | 1 | # On this target file, we get some parse errors on the "bar" field | COMMENT |
| LOW | tests/rules/typed_metavar_metavar_regex.go | 1 | func f(c *http.Request) { | COMMENT |
| LOW | tests/rules/kotlin_slow_import.kt | 21 | // "acceptCharset: ${req.acceptCharset()} \n" + | COMMENT |
| LOW | tests/rules/kotlin_slow_import.kt | 41 | // "local.uri: ${local.uri} \n" + | COMMENT |
| LOW | tests/rules/constprop_bitwise.py | 1 | # Tests for bitwise, shift, unary, floor-division, modulo, and power operator | COMMENT |
| LOW | tests/rules/pattern_regex_inside.py | 1 | # from https://github.com/returntocorp/semgrep/issues/912 | COMMENT |
| LOW | tests/rules/macro_arg_taint.rs | 1 | // if this does not properly translate the macro args, | COMMENT |
| LOW | tests/rules/sym_prop_no_merge1.go | 1 | func test() { | COMMENT |
| LOW | tests/rules/constprop_sccp.py | 1 | # Tests for SCCP (Sparse Conditional Constant Propagation). | COMMENT |
| LOW | tests/rules/taint_labels_rec.rs | 1 | async fn test(client: Client, id: String) -> Option<Json<Post>> { | COMMENT |
| LOW | tests/rules/relevant_rule_badutf8.js | 1 | // Char below somehow causes PCRE engine to throw a BadUTF8 error. | COMMENT |
| LOW | tests/rules/date_comparison.py | 1 | #ok: date_rule | COMMENT |
| LOW | tests/parsing/js/cp_assign_record_assign.js | 1 | // This used to raise `Impossible` during constant propagation because | COMMENT |
| LOW | tests/parsing/dart/dart3_grammar_features.dart | 1 | // Smoke test for grammar features added by the tree-sitter-dart bump: | COMMENT |
| LOW | tests/parsing/java/textblocks.java | 1 | //@Controller | COMMENT |
| LOW | tests/parsing/java/textblocks.java | 21 | COMMENT | |
| LOW | tests/parsing/swift/expressions.swift | 41 | // correctly parsed, even though that issue has been mitigated. | COMMENT |
| LOW | tests/parsing/swift/expressions.swift | 241 | ({ x in x }); | COMMENT |
| LOW | tests/perf/three.js | 30161 | points.push( points[ 0 ] ); | COMMENT |
| LOW | tests/perf/three.js | 30501 | // | COMMENT |
| LOW | tests/perf/three.js | 31321 | // var c = []; | COMMENT |
| LOW | cli/pyproject.toml | 41 | # These specifiers are flexible so semgrep can coexist with other tools. | COMMENT |
| LOW | cli/setup.py | 1 | # | COMMENT |
| LOW | cli/setup.py | 81 | COMMENT | |
| LOW | cli/tests/conftest.py | 1 | # | COMMENT |
| LOW | cli/tests/conftest.py | 21 | # | COMMENT |
| LOW | cli/tests/conftest.py | 601 | # Fixtures | COMMENT |
| LOW | cli/tests/semgrep_runner.py | 1 | # | COMMENT |
| LOW | cli/tests/semgrep_runner.py | 61 | / "semgrep" | COMMENT |
| LOW | cli/tests/fixtures.py | 1 | # | COMMENT |
| 879 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/patterns/python/cp_exception.py | 1 | def throw_must_not_go_through_else(): | CODE |
| LOW⚡ | tests/patterns/python/cp_exception.py | 15 | def no_throw_goes_through_else(): | CODE |
| LOW⚡ | tests/patterns/python/cp_exception.py | 27 | def may_throw_goes_through_catch_and_else(): | CODE |
| LOW⚡ | tests/patterns/python/cp_exception.py | 41 | def exception_or_not_goes_through_finally(): | CODE |
| LOW⚡ | tests/patterns/python/cp_exception.py | 55 | def non_nested_try_statements_are_independent(): | CODE |
| LOW | tests/rules/constprop_bitwise.py | 45 | def test_bitwise_and_no_match(): | CODE |
| LOW | tests/rules/constprop_bitwise.py | 80 | def test_arith_right_shift_negative(): | CODE |
| LOW | tests/rules/constprop_bitwise.py | 94 | def test_non_constant_operand(): | CODE |
| LOW | tests/rules/constprop_bitwise.py | 110 | def test_bitnot_double_is_identity(): | CODE |
| LOW | tests/rules/constprop_bitwise.py | 117 | def test_bitnot_positive_is_negative(): | CODE |
| LOW | tests/rules/constprop_bitwise.py | 135 | def test_floordiv_both_negative(): | CODE |
| LOW | tests/rules/constprop_bitwise.py | 152 | def test_floordiv_non_constant(n): | CODE |
| LOW | tests/rules/constprop_bitwise.py | 161 | def test_floordiv_neg_dividend_drives_sccp(): | CODE |
| LOW | tests/rules/constprop_bitwise.py | 172 | def test_floordiv_neg_divisor_drives_sccp(): | CODE |
| LOW | tests/rules/constprop_sccp_integration.py | 45 | def test_multi_hop_arithmetic(): | CODE |
| LOW | tests/rules/constprop_sccp_integration.py | 95 | def test_loop_invariant_then_sccp(): | CODE |
| LOW | tests/rules/constprop_sccp_integration.py | 128 | def test_floordiv_neg_drives_sccp(): | CODE |
| LOW | tests/rules/constprop_sccp_integration.py | 170 | def test_not_equal_drives_sccp(): | CODE |
| LOW | tests/rules/constprop_sccp_integration.py | 181 | def test_comparison_lte_drives_sccp(): | CODE |
| LOW | tests/rules/constprop_sccp_integration.py | 193 | def test_floordiv_unknown_does_not_drive_sccp(n): | CODE |
| LOW | tests/rules/constprop_sccp_integration.py | 203 | def test_mod_unknown_does_not_drive_sccp(n): | CODE |
| LOW | tests/rules/taint_exception.py | 93 | def throw_must_not_go_through_else(input): | CODE |
| LOW | tests/rules/taint_exception.py | 110 | def no_throw_goes_through_else(input): | CODE |
| LOW | tests/rules/taint_exception.py | 126 | def may_throw_goes_through_catch_and_else(input): | CODE |
| LOW | tests/rules/taint_exception.py | 143 | def exception_or_not_goes_through_finally(input): | CODE |
| LOW | tests/rules/taint_exception.py | 161 | def throw_may_go_through_catch_and_propagates(input): | CODE |
| LOW | tests/rules/constprop_sccp.py | 51 | def test_arithmetic_condition(): | CODE |
| LOW | tests/rules/constprop_sccp.py | 88 | def test_only_defined_in_live_branch(): | CODE |
| LOW | tests/rules/constprop_sccp.py | 102 | def test_dead_branch_propagation(): | CODE |
| LOW | tests/rules/constprop_sccp.py | 173 | def test_greater_than_or_equal_condition(): | CODE |
| LOW | tests/rules/constprop_sccp.py | 184 | def test_less_than_or_equal_false(): | CODE |
| LOW | tests/rules/constprop_sccp.py | 198 | def test_elif_dead_first_branch(): | CODE |
| LOW | tests/rules/constprop_sccp.py | 214 | def test_loop_invariant_drives_sccp(): | CODE |
| LOW | …/parsing/python/async_generators_and_comprehensions.py | 31 | async def await_inside_comprehension(): | CODE |
| LOW | tests/perf/timeout.js | 1075 | function isStartEmulateButtonPresent() { | CODE |
| LOW | tests/perf/timeout.js | 1136 | function checkCartIdFieldAndToggleBind(cartIdField) { | CODE |
| LOW | tests/perf/timeout.js | 1238 | function revertAutocompleteNormalize() { | CODE |
| LOW | tests/perf/timeout.js | 1262 | function addCustomerListBtnHandler() { | CODE |
| LOW | tests/perf/timeout.js | 1343 | function asmAifSectionClickHandler() { | CODE |
| LOW | tests/perf/timeout.js | 1385 | function getCurrentEmulatedCustomerId() { | CODE |
| LOW | tests/perf/timeout.js | 1483 | function populateCustomerListModal(targetUrl, componentToUpdate, callFunction) { | CODE |
| LOW | tests/perf/timeout.js | 1520 | function addRatesTableSorterParser() { | CODE |
| LOW | tests/perf/timeout.js | 1793 | function getNodeFromRowAndCellIndex(rows, rowIndex, cellIndex) { | CODE |
| LOW | tests/perf/timeout.js | 1926 | function computeTableHeaderCellIndexes(t) { | CODE |
| LOW | tests/perf/timeout.js | 1995 | function checkHeaderOptionsSortingLocked(table, i) { | CODE |
| LOW | tests/perf/three.js | 21805 | function materialNeedsSmoothNormals ( material ) { | CODE |
| LOW | tests/perf/three.js | 21833 | function bufferGuessVertexColorType( material ) { | CODE |
| LOW | tests/perf/three.js | 24365 | function unrollImmediateBufferMaterial ( globject ) { | CODE |
| LOW | cli/tests/conftest.py | 103 | def pytest_collection_modifyitems( | CODE |
| LOW | cli/tests/conftest.py | 638 | def _mk_osemgrep_project_root(): | CODE |
| LOW | cli/tests/conftest.py | 685 | def run_semgrep_on_copied_files( | CODE |
| LOW | cli/tests/conftest.py | 704 | def run_semgrep_in_test_folder( | CODE |
| LOW | cli/tests/conftest.py | 757 | def lockfile_path_in_tmp_for_perf(monkeypatch: pytest.MonkeyPatch, tmp_path: Path): | CODE |
| LOW | cli/tests/default/unit/test_version.py | 19 | def test_version_check_caching(tmp_path, mocker, monkeypatch): | CODE |
| LOW | …i/tests/default/unit/test_resolve_dependency_source.py | 28 | def test_handle_missing_parser_for_lockfile(mock_parsers_dict) -> None: | CODE |
| LOW | …i/tests/default/unit/test_resolve_dependency_source.py | 62 | def test_dependency_parser_exception(mock_parsers_dict) -> None: | CODE |
| LOW | …i/tests/default/unit/test_resolve_dependency_source.py | 107 | def test_gradle_module_attribution_rpc_transport(mocker, enabled, persistent): | CODE |
| LOW | cli/tests/default/unit/test_dependency_path_wiring.py | 76 | def test_subproject_deps_feed_the_parent_index(): | CODE |
| LOW | cli/tests/default/unit/test_run_scan.py | 45 | def test_raises_invalid_rule_schema_under_none(): | CODE |
| LOW | cli/tests/default/unit/test_run_scan.py | 56 | def test_no_raise_under_full_even_with_rule_parse_error(): | CODE |
| 848 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .pre-commit-config.yaml | 22 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 24 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 63 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 65 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 165 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 167 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 184 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 186 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 203 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 205 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 227 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 229 | # ---------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/tests/default/unit/test_scans_v2.py | 174 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/tests/default/unit/test_scans_v2.py | 176 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/test_scans_v2.py | 246 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/test_scans_v2.py | 248 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/tests/default/unit/test_scans_v2.py | 268 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/tests/default/unit/test_scans_v2.py | 270 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/parsers/test_maven_install.py | 41 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/parsers/test_maven_install.py | 43 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/parsers/test_maven_install.py | 73 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/parsers/test_maven_install.py | 75 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/parsers/test_maven_install.py | 290 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/parsers/test_maven_install.py | 292 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/parsers/test_maven_install.py | 416 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/unit/parsers/test_maven_install.py | 418 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/mcp/test_supply_chain_hook.py | 21 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/default/mcp/test_supply_chain_hook.py | 23 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/tests/default/mcp/test_supply_chain_hook.py | 159 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/tests/default/mcp/test_supply_chain_hook.py | 161 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/tests/default/mcp/test_supply_chain_hook.py | 213 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/tests/default/mcp/test_supply_chain_hook.py | 215 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/git.py | 487 | # ============================== | STRING |
| MEDIUM | cli/src/semgrep/git.py | 489 | # ============================== | STRING |
| MEDIUM | cli/src/semgrep/git.py | 512 | # ================================== | STRING |
| MEDIUM | cli/src/semgrep/git.py | 514 | # ================================== | STRING |
| MEDIUM | cli/src/semgrep/run_scan.py | 1086 | # --------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1088 | # --------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1122 | # --------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1124 | # --------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1148 | # --------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1150 | # --------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1171 | # --------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1173 | # --------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1380 | # ---------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1382 | # ---------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1465 | # ---------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1467 | # ---------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1504 | # ---------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1506 | # ---------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1597 | # ---------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1599 | # ---------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1669 | # --------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1671 | # --------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1726 | # --------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1728 | # --------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1752 | # --------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/run_scan.py | 1754 | # --------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/mcp/server.py | 71 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/src/semgrep/mcp/server.py | 73 | # --------------------------------------------------------------------------------- | COMMENT |
| 40 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/precommit_dogfooding/python.yml | 6561 | - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(..., | CODE |
| CRITICAL | tests/precommit_dogfooding/python.yml | 6563 | - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE, | CODE |
| CRITICAL | tests/precommit_dogfooding/python.yml | 7675 | - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) | CODE |
| CRITICAL | tests/precommit_dogfooding/python.yml | 8333 | pattern: cryptography.hazmat.primitives.ciphers.algorithms.ARC4(...) | CODE |
| CRITICAL | tests/precommit_dogfooding/python.yml | 8539 | pattern: cryptography.hazmat.primitives.ciphers.algorithms.Blowfish(...) | CODE |
| CRITICAL | tests/precommit_dogfooding/python.yml | 8807 | - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., | CODE |
| CRITICAL | tests/precommit_dogfooding/python.yml | 8809 | - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP, | CODE |
| CRITICAL | tests/precommit_dogfooding/python.yml | 8903 | pattern: cryptography.hazmat.primitives.ciphers.algorithms.IDEA(...) | CODE |
| CRITICAL | tests/precommit_dogfooding/python.yml | 9143 | pattern: cryptography.hazmat.primitives.ciphers.modes.ECB(...) | CODE |
| CRITICAL | tests/rules/not_found_exn2.yaml | 7 | cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., key_size=$VALUE, ...) | CODE |
| CRITICAL | tests/rules/tainted-file-path.yaml | 10 | org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file | CODE |
| CRITICAL | …rc/semgrep-scala/test/corpus/semgrep_real_patterns.txt | 444 | com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET); | CODE |
| CRITICAL | …g/javascript/test/ok/pfff/parsing/big/minimized.min.js | 30 | h.material.uniforms.t2D.value=d;!0===d.matrixAutoUpdate&&d.updateMatrix();h.material.uniforms.uvTransform.value.copy(d.m | CODE |
| CRITICAL | perf/r2c-rules/r2c-security-audit.yml | 1055 | method such as org.apache.commons.io.FilenameUtils.getName(...) to only | CODE |
| CRITICAL | perf/r2c-rules/r2c-security-audit.yml | 2020 | - pattern: java.nio.file.Files.setPosixFilePermissions($FILE, java.nio.file.attribute.PosixFilePermissions.fromStr | CODE |
| CRITICAL | perf/r2c-rules/r2c-security-audit.yml | 2022 | $TYPE $P = java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x | CODE |
| CRITICAL | perf/r2c-rules/r2c-security-audit.yml | 2418 | method such as org.apache.commons.io.FilenameUtils.getName(...) to only | CODE |
| CRITICAL | perf/r2c-rules/r2c-security-audit.yml | 3800 | pattern: cryptography.hazmat.primitives.ciphers.algorithms.Blowfish(...) | CODE |
| CRITICAL | perf/r2c-rules/r2c-security-audit.yml | 3815 | pattern: cryptography.hazmat.primitives.ciphers.algorithms.IDEA(...) | CODE |
| CRITICAL | perf/r2c-rules/r2c-security-audit.yml | 3830 | pattern: cryptography.hazmat.primitives.ciphers.algorithms.ARC4(...) | CODE |
| CRITICAL | perf/r2c-rules/r2c-security-audit.yml | 3846 | pattern: cryptography.hazmat.primitives.ciphers.modes.ECB(...) | CODE |
| CRITICAL | perf/r2c-rules/r2c-security-audit.yml | 3899 | - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) | CODE |
| CRITICAL | perf/r2c-rules/r2c-ci.yml | 556 | method such as org.apache.commons.io.FilenameUtils.getName(...) to only | CODE |
| CRITICAL | perf/r2c-rules/r2c-ci.yml | 891 | method such as org.apache.commons.io.FilenameUtils.getName(...) to only | CODE |
| CRITICAL | perf/r2c-rules/r2c-ci.yml | 1784 | pattern: cryptography.hazmat.primitives.ciphers.algorithms.Blowfish(...) | CODE |
| CRITICAL | perf/r2c-rules/r2c-ci.yml | 1799 | pattern: cryptography.hazmat.primitives.ciphers.algorithms.IDEA(...) | CODE |
| CRITICAL | perf/r2c-rules/r2c-ci.yml | 1814 | pattern: cryptography.hazmat.primitives.ciphers.algorithms.ARC4(...) | CODE |
| CRITICAL | perf/r2c-rules/r2c-ci.yml | 1830 | pattern: cryptography.hazmat.primitives.ciphers.modes.ECB(...) | CODE |
| CRITICAL | perf/r2c-rules/r2c-ci.yml | 1883 | - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) | CODE |
| CRITICAL | perf/r2c-rules/java.yml | 16 | method such as org.apache.commons.io.FilenameUtils.getName(...) to only | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/patterns/python/deep_try.py | 5 | except Exception: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 4 | except C: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 6 | except B: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 8 | except A: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 14 | except C: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 16 | except A: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 18 | except B: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 23 | except C: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 25 | except A: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 30 | except C: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 32 | except B: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 37 | except A: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 42 | except B: | CODE |
| HIGH | tests/patterns/python/less_catch_multiple.py | 44 | except: | CODE |
| HIGH | tests/patterns/python/misc_except_matching.py | 4 | except ValueError: | CODE |
| HIGH | tests/patterns/python/misc_except_matching.py | 10 | except (ValueError, TypeError): | CODE |
| HIGH | tests/patterns/python/misc_except_matching.py | 16 | except (ValueError): | CODE |
| HIGH | tests/patterns/python/dots_except_as.py | 4 | except HTTPError as e: | CODE |
| HIGH | tests/patterns/python/less_catch.py | 4 | except B: | CODE |
| HIGH | tests/patterns/python/less_catch.py | 6 | except A: | CODE |
| HIGH | tests/patterns/python/less_catch.py | 12 | except A: | CODE |
| HIGH | tests/patterns/python/less_catch.py | 14 | except B: | CODE |
| HIGH | tests/patterns/python/less_catch.py | 19 | except: | CODE |
| HIGH | tests/patterns/python/less_catch.py | 24 | except B: | CODE |
| HIGH | cli/setup.py | 41 | except Exception: | CODE |
| HIGH | cli/src/semdep/parsers/maven_install.py | 153 | except Exception: | CODE |
| HIGH | cli/src/semdep/parsers/maven_install.py | 230 | except Exception: | CODE |
| HIGH | cli/src/semdep/external/packaging/tags.py | 208 | except ValueError: | CODE |
| HIGH | cli/src/semgrep/parsing_data.py | 55 | except OSError: | CODE |
| HIGH | cli/src/semgrep/parsing_data.py | 98 | except OSError: | CODE |
| HIGH | cli/src/semgrep/core_runner.py | 264 | except BaseException: # noqa: B036 | CODE |
| HIGH | cli/src/semgrep/rpc.py | 107 | except (OSError, ValueError): | CODE |
| HIGH | cli/src/semgrep/rpc.py | 580 | except subprocess.TimeoutExpired: | CODE |
| HIGH | cli/src/semgrep/rpc.py | 566 | except subprocess.TimeoutExpired: | CODE |
| HIGH | cli/src/semgrep/engine.py | 147 | except (OSError, ValueError): | CODE |
| HIGH | cli/src/semgrep/config_resolver.py | 216 | except Exception: | CODE |
| HIGH | cli/src/semgrep/config_resolver.py | 365 | except Exception: | CODE |
| HIGH | cli/src/semgrep/rule_lang.py | 492 | except FileNotFoundError: | CODE |
| HIGH | cli/src/semgrep/app/session.py | 82 | except (OSError, subprocess.CalledProcessError): | CODE |
| HIGH | cli/src/semgrep/console_scripts/entrypoint.py | 128 | except (FileNotFoundError, ModuleNotFoundError): | CODE |
| HIGH | cli/src/semgrep/commands/install.py | 149 | except Exception: | CODE |
| HIGH | …/ocaml-tree-sitter-semgrep/scripts/grammar_registry.py | 57 | except UnknownGrammarError: | CODE |
| HIGH | .github/workflows/libs/bump-uses.py | 87 | except (FileNotFoundError, subprocess.TimeoutExpired): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/patterns/python/wildcard_qualified.py | 1 | CODE | |
| LOW | tests/patterns/python/already_resolved_with_wildcard.py | 2 | CODE | |
| LOW | tests/patterns/python/misc_import.py | 2 | CODE | |
| LOW | tests/patterns/python/misc_import.py | 4 | CODE | |
| LOW | tests/patterns/python/scoped_wildcard.py | 11 | CODE | |
| LOW | tests/patterns/python/import_negatives.py | 2 | CODE | |
| LOW | tests/patterns/python/import_negatives.py | 4 | CODE | |
| LOW | tests/patterns/python/import_negatives.py | 6 | CODE | |
| LOW | tests/patterns/python/import_negatives2.py | 2 | CODE | |
| LOW | tests/patterns/python/import_negatives2.py | 4 | CODE | |
| LOW | tests/patterns/python/import_negatives2.py | 6 | CODE | |
| LOW | tests/patterns/python/import_metavar_fullpath.py | 6 | CODE | |
| LOW | tests/patterns/python/import_metavar_fullpath.py | 8 | CODE | |
| LOW | tests/patterns/python/import_metavar_fullpath.py | 10 | CODE | |
| LOW | tests/patterns/python/import_metavar_fullpath.py | 12 | CODE | |
| LOW | tests/patterns/python/import_metavar_fullpath.py | 14 | CODE | |
| LOW | tests/patterns/python/import_metavar_fullpath.py | 16 | CODE | |
| LOW | tests/patterns/python/misc_regression1.py | 1 | CODE | |
| LOW | tests/patterns/python/imports.py | 3 | CODE | |
| LOW | tests/patterns/python/imports.py | 6 | CODE | |
| LOW | tests/patterns/python/imports.py | 8 | CODE | |
| LOW | tests/patterns/python/imports.py | 11 | CODE | |
| LOW | tests/patterns/python/imports.py | 12 | CODE | |
| LOW | tests/patterns/python/imports.py | 12 | CODE | |
| LOW | tests/patterns/python/imports.py | 14 | CODE | |
| LOW | tests/patterns/python/imports.py | 14 | CODE | |
| LOW | tests/patterns/python/imports.py | 16 | CODE | |
| LOW | tests/patterns/python/imports.py | 16 | CODE | |
| LOW | tests/patterns/python/imports.py | 20 | CODE | |
| LOW | tests/patterns/python/imports.py | 21 | CODE | |
| LOW | tests/patterns/python/imports.py | 22 | CODE | |
| LOW | tests/patterns/python/imports.py | 23 | CODE | |
| LOW | tests/patterns/python/imports.py | 25 | CODE | |
| LOW | tests/patterns/python/imports.py | 26 | CODE | |
| LOW | tests/patterns/python/imports.py | 27 | CODE | |
| LOW | tests/patterns/python/imports.py | 28 | CODE | |
| LOW | tests/patterns/python/imports.py | 29 | CODE | |
| LOW | tests/patterns/python/imports.py | 30 | CODE | |
| LOW | tests/patterns/python/imports.py | 31 | CODE | |
| LOW | tests/patterns/python/imports.py | 32 | CODE | |
| LOW | tests/patterns/python/imports.py | 33 | CODE | |
| LOW | tests/patterns/python/imports.py | 36 | CODE | |
| LOW | tests/patterns/python/imports.py | 36 | CODE | |
| LOW | tests/patterns/python/imports.py | 39 | CODE | |
| LOW | tests/patterns/python/imports.py | 39 | CODE | |
| LOW | tests/patterns/python/imports.py | 42 | CODE | |
| LOW | tests/patterns/python/imports.py | 45 | CODE | |
| LOW | tests/patterns/python/imports.py | 46 | CODE | |
| LOW | tests/patterns/python/imports.py | 47 | CODE | |
| LOW | tests/patterns/python/imports.py | 48 | CODE | |
| LOW | tests/patterns/python/imports.py | 50 | CODE | |
| LOW | tests/patterns/python/imports.py | 51 | CODE | |
| LOW | tests/patterns/python/imports.py | 52 | CODE | |
| LOW | tests/patterns/python/imports.py | 53 | CODE | |
| LOW | tests/patterns/python/imports.py | 54 | CODE | |
| LOW | tests/patterns/python/imports.py | 55 | CODE | |
| LOW | tests/patterns/python/imports.py | 56 | CODE | |
| LOW | tests/patterns/python/imports.py | 57 | CODE | |
| LOW | tests/patterns/python/imports.py | 62 | CODE | |
| LOW | tests/patterns/python/imports.py | 62 | CODE | |
| 139 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CHANGELOG.md | 3064 | except Exception: | CODE |
| LOW | CHANGELOG.md | 10598 | except Exception: | CODE |
| LOW | tests/patterns/python/deep_try.py | 5 | except Exception: | CODE |
| LOW⚡ | tests/patterns/python/cp_exception.py | 5 | except Exception as e: | CODE |
| LOW⚡ | tests/patterns/python/cp_exception.py | 19 | except Exception as e: | CODE |
| LOW⚡ | tests/patterns/python/cp_exception.py | 31 | except Exception as e: | CODE |
| LOW⚡ | tests/patterns/python/cp_exception.py | 45 | except Exception as e: | CODE |
| LOW⚡ | tests/patterns/python/cp_exception.py | 62 | except Exception as e: | CODE |
| LOW | tests/patterns/python/cp_exception.py | 75 | except Exception as e: | CODE |
| LOW | tests/patterns/python/misc_exn.py | 5 | except Exception: | CODE |
| LOW | tests/rules/taint_exception.py | 14 | except Exception as e: | CODE |
| LOW | tests/rules/taint_exception.py | 25 | except Exception as e: | CODE |
| LOW | tests/rules/taint_exception.py | 59 | except Exception as e: | CODE |
| LOW | tests/rules/taint_exception.py | 70 | except Exception as e: | CODE |
| LOW | tests/rules/taint_exception.py | 98 | except Exception as e: | CODE |
| LOW | tests/rules/taint_exception.py | 115 | except Exception as e: | CODE |
| LOW | tests/rules/taint_exception.py | 131 | except Exception as e: | CODE |
| LOW | tests/rules/taint_exception.py | 148 | except Exception as e: | CODE |
| LOW | tests/rules/taint_exception.py | 171 | except Exception as e: | CODE |
| LOW | tests/rules/taint_exception.py | 185 | except Exception as e: | CODE |
| LOW | tests/rules/taint_clean_in_try_no_finally.py | 5 | except Exception: | CODE |
| LOW | tests/parsing/python/as_pattern.py | 3 | except Exception as e: | CODE |
| LOW | cli/setup.py | 41 | except Exception: | CODE |
| MEDIUM | cli/setup.py | 30 | def linux_detect_libc(): | CODE |
| LOW | cli/tests/default/unit/test_error_handler.py | 185 | except Exception: | CODE |
| LOW | cli/tests/default/unit/test_error_handler.py | 223 | except Exception: | CODE |
| LOW | cli/tests/default/unit/test_error_handler.py | 254 | except Exception: | CODE |
| LOW | cli/src/semdep/package_restrictions.py | 59 | except Exception as e: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 111 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 118 | except Exception: | CODE |
| LOW⚡ | cli/src/semdep/parsers/maven_install.py | 145 | except Exception: | CODE |
| LOW⚡ | cli/src/semdep/parsers/maven_install.py | 153 | except Exception: | CODE |
| LOW⚡ | cli/src/semdep/parsers/maven_install.py | 158 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 196 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 207 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 212 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 230 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 256 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 267 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 279 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 286 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/maven_install.py | 335 | except Exception: | CODE |
| LOW | cli/src/semdep/parsers/util.py | 92 | except Exception as e: | CODE |
| LOW | cli/src/semdep/parsers/util.py | 382 | except Exception as e: | CODE |
| LOW | cli/src/semdep/parsers/poetry.py | 281 | except Exception as e: | CODE |
| MEDIUM | cli/src/semgrep/metrics.py | 532 | def clear_install_pro_error(self) -> None: | CODE |
| MEDIUM | cli/src/semgrep/metrics.py | 750 | def gather_click_params(self) -> None: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 286 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 295 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 301 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 475 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 483 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 491 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 497 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 503 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 509 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 515 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 523 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 529 | except Exception as e: | CODE |
| LOW⚡ | cli/src/semgrep/metrics.py | 535 | except Exception as e: | CODE |
| 77 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | semgrep.yml | 1 | # This file contains Semgrep rules. See https://semgrep.dev for more info. | COMMENT |
| MEDIUM | semgrep.yml | 8 | # This file is also used in CI, see .circleci/config.yml | COMMENT |
| MEDIUM | cli/tests/default/unit/test_saved_scan_config.py | 56 | # Create a handler that will dump the config when handling a scan response | COMMENT |
| MEDIUM | cli/tests/default/unit/test_saved_scan_config.py | 70 | # Create a second handler that loads the saved config via start_scan | COMMENT |
| MEDIUM | cli/tests/default/unit/test_symbol_analysis.py | 169 | # Create a Java file and gradle lockfile | COMMENT |
| MEDIUM | cli/tests/default/unit/test_symbol_analysis.py | 553 | # Create a subproject directory but scan a different directory | COMMENT |
| MEDIUM | cli/tests/default/e2e-other/parsers/test_yarn.py | 297 | """# This file is generated by running "yarn install" inside your project. | STRING |
| MEDIUM | cli/tests/default/e2e-other/parsers/test_yarn.py | 405 | """# This file is generated by running "yarn install" inside your project. | STRING |
| MEDIUM | cli/tests/default/e2e/test_ignores.py | 29 | # This file is included by the .semgrepignore above. | COMMENT |
| MEDIUM | cli/tests/default/e2e/test_diff_scan_preserves_repo.py | 51 | # Create the rule file (untracked) | COMMENT |
| MEDIUM | …fault/e2e/targets/parse_metrics/partial-parse-error.rb | 193 | # This method is called to process HTTP requests | COMMENT |
| MEDIUM | cli/tests/default/e2e/targets/parse_metrics/ok.rb | 33 | # Create an instance of the Sensu client process, start the | COMMENT |
| MEDIUM | cli/tests/default/e2e/targets/parse_metrics/ok.rb | 57 | # Create a Sensu client keepalive payload, to be sent over the | COMMENT |
| MEDIUM | cli/tests/default/e2e/targets/parse_metrics/ok.rb | 125 | # Create an in progress key for a check, used to determine if an | COMMENT |
| MEDIUM | cli/tests/default/e2e/targets/parse_metrics/ok.rb | 377 | # Create a check execution proc, used to execute standalone | COMMENT |
| MEDIUM | cli/tests/default/e2e/targets/parse_metrics/ok.rb | 560 | # Create a check result intended for deregistering a client. | COMMENT |
| MEDIUM | …default/e2e/targets/dependency_aware/dart/pubspec.yaml | 66 | # The following section is specific to Flutter packages. | COMMENT |
| MEDIUM | cli/src/semdep/parsers/composer.py | 17 | # Import necessary modules and classes | COMMENT |
| MEDIUM | cli/src/semdep/parsers/util.py | 76 | """This class is a callable wrapper around a lockfile and manifest parser | STRING |
| MEDIUM | cli/src/semdep/parsers/yarn.py | 302 | # This file is generated by running "yarn install" inside your project. | COMMENT |
| MEDIUM | cli/src/semdep/matchers/pip_requirements.py | 178 | # Create a subproject from each group of requirements files and the corresponding manifest | COMMENT |
| MEDIUM | cli/src/semdep/external/packaging/tags.py | 2 | # This file is dual licensed under the terms of the Apache License, Version | COMMENT |
| MEDIUM | cli/src/semdep/external/packaging/version.py | 2 | # This file is dual licensed under the terms of the Apache License, Version | COMMENT |
| MEDIUM | cli/src/semdep/external/packaging/__init__.py | 1 | # This file is dual licensed under the terms of the Apache License, Version | COMMENT |
| MEDIUM | cli/src/semdep/external/packaging/utils.py | 2 | # This file is dual licensed under the terms of the Apache License, Version | COMMENT |
| MEDIUM | cli/src/semdep/external/packaging/_structures.py | 2 | # This file is dual licensed under the terms of the Apache License, Version | COMMENT |
| MEDIUM | cli/src/semdep/external/packaging/__about__.py | 1 | # This file is dual licensed under the terms of the Apache License, Version | COMMENT |
| MEDIUM | cli/src/semdep/external/packaging/specifiers.py | 2 | # This file is dual licensed under the terms of the Apache License, Version | COMMENT |
| MEDIUM | cli/src/semgrep/profile_manager.py | 25 | # This method is an even more rudimentary tool for profiling | COMMENT |
| MEDIUM | cli/src/semgrep/test.py | 13 | # This file is DEPRECATED! Please modify instead osemgrep test in | COMMENT |
| MEDIUM | cli/src/semgrep/join_rule.py | 558 | # Create a model map. This allows dynamically creating DB tables based | COMMENT |
| MEDIUM | cli/src/semgrep/output_extra.py | 22 | # This class is easily extendable if we want to add more information to the CLI output | COMMENT |
| MEDIUM | cli/src/semgrep/output.py | 133 | # This class is the internal representation of OutputSettings below. | COMMENT |
| MEDIUM | cli/src/semgrep/mcp/server.py | 257 | # Create a temporary directory | COMMENT |
| MEDIUM | cli/src/semgrep/console_scripts/entrypoint.py | 2 | # This file is the Semgrep CLI entry point of the Semgrep pip package, | COMMENT |
| MEDIUM | cli/src/semgrep/console_scripts/pysemgrep.py | 16 | # This file is not part of the Python 'semgrep' package; it's a script. | COMMENT |
| MEDIUM | cli/src/semgrep/commands/mcp.py | 185 | # Create a fast MCP server | STRING |
| MEDIUM | cli/src/semgrep/external/git_url_parser.py | 1 | # This file is forked from https://github.com/coala/git-url-parse/blob/master/giturlparse/parser.py | COMMENT |
| MEDIUM | …bs/ocaml-tree-sitter-semgrep/lang/ruby/test/ok/poly.rb | 69 | # Create a string of the polynomial in sort-of-readable form. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/setup.py | 76 | CODE | |
| LOW | cli/tests/conftest.py | 313 | CODE | |
| LOW | cli/tests/conftest.py | 425 | CODE | |
| LOW | cli/tests/default/unit/test_semgrep_test.py | 50 | CODE | |
| LOW | cli/tests/default/e2e-other/test_ssc.py | 841 | CODE | |
| LOW | cli/src/semdep/golang_version.py | 226 | CODE | |
| LOW | cli/src/semdep/golang_version.py | 332 | CODE | |
| LOW | cli/src/semdep/package_restrictions.py | 30 | CODE | |
| LOW | cli/src/semdep/maven_version.py | 98 | CODE | |
| LOW | cli/src/semdep/maven_version.py | 138 | CODE | |
| LOW | cli/src/semdep/parsers/maven_install.py | 188 | CODE | |
| LOW | cli/src/semdep/parsers/pnpm.py | 480 | CODE | |
| LOW | cli/src/semdep/parsers/composer.py | 61 | CODE | |
| LOW | cli/src/semdep/parsers/go_mod.py | 107 | CODE | |
| LOW | cli/src/semdep/parsers/pom_tree.py | 91 | CODE | |
| LOW | cli/src/semdep/parsers/pubspec_lock.py | 39 | CODE | |
| LOW | cli/src/semdep/matchers/gradle.py | 98 | CODE | |
| LOW | cli/src/semdep/external/packaging/tags.py | 314 | CODE | |
| LOW | cli/src/semdep/external/packaging/tags.py | 346 | CODE | |
| LOW | cli/src/semdep/external/packaging/version.py | 197 | CODE | |
| LOW | cli/src/semdep/external/packaging/version.py | 394 | CODE | |
| LOW | cli/src/semdep/external/packaging/_manylinux.py | 267 | CODE | |
| LOW | cli/src/semdep/external/packaging/specifiers.py | 752 | CODE | |
| LOW | cli/src/semgrep/dependency_aware_rule.py | 312 | CODE | |
| LOW | cli/src/semgrep/dependency_aware_rule.py | 497 | CODE | |
| LOW | cli/src/semgrep/dependency_aware_rule.py | 192 | CODE | |
| LOW | cli/src/semgrep/scan_report.py | 253 | CODE | |
| LOW | cli/src/semgrep/scan_report.py | 266 | CODE | |
| LOW | cli/src/semgrep/metrics.py | 353 | CODE | |
| LOW | cli/src/semgrep/subproject.py | 148 | CODE | |
| LOW | cli/src/semgrep/subproject.py | 170 | CODE | |
| LOW | cli/src/semgrep/subproject.py | 186 | CODE | |
| LOW | cli/src/semgrep/subproject.py | 433 | CODE | |
| LOW | cli/src/semgrep/error_location.py | 162 | CODE | |
| LOW | cli/src/semgrep/error.py | 249 | CODE | |
| LOW | cli/src/semgrep/error.py | 563 | CODE | |
| LOW | cli/src/semgrep/error.py | 565 | CODE | |
| LOW | cli/src/semgrep/symbol_analysis.py | 87 | CODE | |
| LOW | cli/src/semgrep/symbol_analysis.py | 201 | CODE | |
| LOW | cli/src/semgrep/rule_match.py | 516 | CODE | |
| LOW | cli/src/semgrep/rule_match.py | 579 | CODE | |
| LOW | cli/src/semgrep/test.py | 161 | CODE | |
| LOW | cli/src/semgrep/core_runner.py | 313 | CODE | |
| LOW | cli/src/semgrep/core_runner.py | 847 | CODE | |
| LOW | cli/src/semgrep/core_runner.py | 933 | CODE | |
| LOW | cli/src/semgrep/run_scan.py | 272 | CODE | |
| LOW | cli/src/semgrep/run_scan.py | 406 | CODE | |
| LOW | cli/src/semgrep/run_scan.py | 483 | CODE | |
| LOW | cli/src/semgrep/run_scan.py | 701 | CODE | |
| LOW | cli/src/semgrep/run_scan.py | 986 | CODE | |
| LOW | cli/src/semgrep/run_scan.py | 1049 | CODE | |
| LOW | cli/src/semgrep/run_scan.py | 1276 | CODE | |
| LOW | cli/src/semgrep/target_manager.py | 96 | CODE | |
| LOW | cli/src/semgrep/target_manager.py | 239 | CODE | |
| LOW | cli/src/semgrep/target_manager.py | 302 | CODE | |
| LOW | cli/src/semgrep/target_manager.py | 1194 | CODE | |
| LOW | cli/src/semgrep/join_rule.py | 140 | CODE | |
| LOW | cli/src/semgrep/rpc.py | 325 | CODE | |
| LOW | cli/src/semgrep/rpc.py | 97 | CODE | |
| LOW | cli/src/semgrep/engine.py | 45 | CODE | |
| 41 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .pre-commit-hooks.yaml | 14 | # for pre-commit. Essentially, setup.py runs 'pip install semgrep==0.xxx.yyy'. | COMMENT |
| MEDIUM | tests/perf/l10000.js | 3514 | // this is a more robust check for empty than ( volume <= 0 ) because volume can get positive with two negative axes | COMMENT |
| MEDIUM | tests/perf/l10000.js | 3838 | // this is a more robust check for empty than ( volume <= 0 ) because volume can get positive with two negative axes | COMMENT |
| MEDIUM | tests/perf/three.js | 3514 | // this is a more robust check for empty than ( volume <= 0 ) because volume can get positive with two negative axes | COMMENT |
| MEDIUM | tests/perf/three.js | 3838 | // this is a more robust check for empty than ( volume <= 0 ) because volume can get positive with two negative axes | COMMENT |
| MEDIUM | tests/perf/bloom/l10000.js | 3515 | // this is a more robust check for empty than ( volume <= 0 ) because volume can get positive with two negative axes | COMMENT |
| MEDIUM | tests/perf/bloom/l10000.js | 3839 | // this is a more robust check for empty than ( volume <= 0 ) because volume can get positive with two negative axes | COMMENT |
| MEDIUM | cli/tests/default/e2e/targets/parse_metrics/ok.rb | 143 | # tokens. Hook commands may expect/read and utilize JSON | COMMENT |
| MEDIUM | cli/tests/default/e2e/targets/parse_metrics/ok.rb | 251 | # method as a parameter, the extension may utilize it. This | COMMENT |
| MEDIUM | cli/tests/default/e2e/targets/bad/invalid_c_long.c | 1 | /*;--------------------------------------------------------------------------;;This program, "bzip2", the associated lib | COMMENT |
| LOW | cli/src/semdep/parsers/gradle.py | 105 | # support for manifest parsing. In that case just use the lockfile. | COMMENT |
| LOW | cli/src/semdep/external/packaging/specifiers.py | 500 | # version. If it's not we can short circuit and just return False now | STRING |
| LOW | cli/src/semdep/external/packaging/specifiers.py | 526 | # version. If it's not we can short circuit and just return False now | STRING |
| LOW | cli/src/semdep/external/packaging/specifiers.py | 707 | # then we'll just return None since we don't know if this should have | STRING |
| MEDIUM | cli/src/semgrep/dependency_aware_rule.py | 470 | # TODO: associate these in a more robust way. This currently | COMMENT |
| LOW | cli/src/semgrep/git.py | 420 | # If we already know that the base commit is the merge base, just return | STRING |
| LOW | cli/src/semgrep/error.py | 541 | # TODO: generalize in a SemgrepCliError and just pass the level, code and type_ | COMMENT |
| LOW | cli/src/semgrep/rpc.py | 274 | # date, let's just use a catch-all. In the end it doesn't really matter | COMMENT |
| LOW | cli/src/semgrep/rule.py | 339 | # /weird/), just return the empty string, and we'll hash based on rule id + | COMMENT |
| MEDIUM | cli/src/semgrep/resolve_dependency_source.py | 467 | # TODO: Reimplement this once more robust error handling for lockfileless resolution is implemented | COMMENT |
| LOW | cli/src/semgrep/mcp/semgrep.py | 235 | # if they exist on the local filesystem, we could just pass the paths | COMMENT |
| LOW | cli/src/semgrep/console_scripts/entrypoint.py | 18 | # semgrep-core, but it is simple from Python because you can simply use | COMMENT |
| MEDIUM | cli/src/semgrep/console_scripts/entrypoint.py | 22 | # Again, it is simpler to use a Python script and leverage importlib.resources. | COMMENT |
| MEDIUM | cli/src/semgrep/console_scripts/entrypoint.py | 172 | # test harness, etc.), set NO_COLOR so cmdliner reverts to plain output. | COMMENT |
| LOW | cli/src/semgrep/semgrep_interfaces/rule_schema_v1.yaml | 281 | # I would normally just use `allOf`, but since it doensn't short circuit, | COMMENT |
| MEDIUM | cli/src/semgrep/semgrep_interfaces/generate.py | 80 | # Constructors are sorted by increasing maturity to facilitate meaningful | COMMENT |
| LOW | cli/src/semgrep/commands/ci.py | 1075 | # settings have been passed. So we can just use the "normal" | COMMENT |
| MEDIUM | cli/src/semgrep/commands/scan.py | 877 | # I wish there was an easy way to leverage the engine_params from the | COMMENT |
| MEDIUM | …-hack/fyi/semgrep-grammars/src/semgrep-hack/grammar.js | 52 | // By using an empty statement, we leverage a statement type that is strictly only used within | COMMENT |
| MEDIUM | …grep/lang/semgrep-grammars/src/semgrep-hack/grammar.js | 52 | // By using an empty statement, we leverage a statement type that is strictly only used within | COMMENT |
| MEDIUM | …e-sitter-semgrep/scripts/test_scanner_memory_safety.py | 84 | # (scanner.c to test, directory holding its tree_sitter/ headers, harness) | STRING |
| MEDIUM | …e-sitter-semgrep/scripts/test_scanner_memory_safety.py | 111 | source.write_text(f'#include "{scanner}"\n{harness}') | CODE |
| MEDIUM | perf/configs/ci_small_repos.yaml | 85 | # For more comprehensive rule timing information | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/perf/timeout.js | 749 | if (input.val() == input.attr('placeholder')) { | CODE |
| LOW⚡ | tests/perf/timeout.js | 751 | input.removeClass('placeholder'); | CODE |
| LOW⚡ | tests/perf/timeout.js | 755 | if (input.val() == '' || input.val() == input.attr('placeholder')) { | CODE |
| LOW⚡ | tests/perf/timeout.js | 756 | input.addClass('placeholder'); | CODE |
| LOW⚡ | tests/perf/timeout.js | 757 | input.val(input.attr('placeholder')); | CODE |
| LOW | tests/perf/timeout.js | 980 | if (input.val() == input.attr('placeholder')) { | CODE |
| LOW | tests/perf/timeout.js | 1091 | return !('placeholder' in i); | CODE |
| LOW | tests/perf/timeout.js | 1137 | if (!$(cartIdField).hasClass('placeholder') && $("input[name='customerId']").val().length > 0) { | CODE |
| LOW | tests/perf/timeout.js | 1177 | if (!$(el).hasClass('placeholder')) { | CODE |
| LOW | cli/tests/conftest.py | 497 | env_["SEMGREP_APP_TOKEN"] = "fake_token" | CODE |
| LOW⚡ | cli/tests/default/e2e-other/test_login.py | 46 | # for the input=fake_key to work? | COMMENT |
| LOW⚡ | cli/tests/default/e2e-other/test_login.py | 49 | fake_key = "key123" | CODE |
| LOW⚡ | cli/tests/default/e2e-other/test_login.py | 56 | input=fake_key, | CODE |
| LOW | cli/tests/default/e2e-other/test_login.py | 70 | fake_key = "key123" | CODE |
| LOW | cli/tests/default/e2e-other/test_login.py | 84 | env={"SEMGREP_APP_TOKEN": fake_key}, | CODE |
| LOW | cli/tests/default/e2e-other/test_login.py | 110 | fake_key = "key123" | CODE |
| LOW | cli/tests/default/e2e-other/test_login.py | 122 | env={"SEMGREP_APP_TOKEN": fake_key}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1339 | # env["SEMGREP_APP_TOKEN"] = "fake-key-from-tests" | COMMENT |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1031 | env["SEMGREP_APP_TOKEN"] = "fake-key-from-tests" | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1203 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1500 | env["SEMGREP_APP_TOKEN"] = "fake-key-from-tests" | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1651 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1692 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1722 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1753 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1816 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 1861 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2009 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2047 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2100 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2137 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2190 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2224 | "SEMGREP_APP_TOKEN": "fake-key-from-tests", | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2253 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2290 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2312 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2341 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2360 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2379 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2398 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2421 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2464 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2504 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2538 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2557 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2590 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2609 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2627 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2646 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2700 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2742 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2792 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2866 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 2935 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 3017 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 3058 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 3213 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 3410 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 3509 | env={"SEMGREP_APP_TOKEN": "fake-key-from-tests"}, | CODE |
| LOW | cli/tests/default/e2e-other/test_ci.py | 3605 | env={"SEMGREP_APP_TOKEN": "fake_key"}, | CODE |
| 23 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/src/semgrep/target_manager.py | 250 | # this print statement we need to check if any target is in a | COMMENT |
| LOW | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 38 | // Step 1: Select four points arbitrarily to form the initial simplex (tetrahedron) | COMMENT |
| LOW | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 90 | // Step 1: Check if our latest point is outside of the hull | COMMENT |
| LOW⚡ | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 103 | // Step 2: Clean the way for ourselves (Resets the "isFacing" sentinels on the Vertices) | COMMENT |
| LOW⚡ | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 106 | // Step 3: Mark all the vertices on the horizon | COMMENT |
| LOW⚡ | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 115 | // Step 4: Remind each vertex what its original index was (foreshadowing!) | COMMENT |
| LOW⚡ | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 119 | // Step 5: Sort the horizon vertices clockwise about the point-average-average axis | COMMENT |
| LOW | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 137 | // Step 6: Create new triangles around this horizon and call it good... | COMMENT |
| LOW | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 271 | // Step 0: Contrive some points | COMMENT |
| LOW | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 38 | // Step 1: Select four points arbitrarily to form the initial simplex (tetrahedron) | COMMENT |
| LOW | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 90 | // Step 1: Check if our latest point is outside of the hull | COMMENT |
| LOW⚡ | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 103 | // Step 2: Clean the way for ourselves (Resets the "isFacing" sentinels on the Vertices) | COMMENT |
| LOW⚡ | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 106 | // Step 3: Mark all the vertices on the horizon | COMMENT |
| LOW⚡ | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 115 | // Step 4: Remind each vertex what its original index was (foreshadowing!) | COMMENT |
| LOW⚡ | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 119 | // Step 5: Sort the horizon vertices clockwise about the point-average-average axis | COMMENT |
| LOW | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 137 | // Step 6: Create new triangles around this horizon and call it good... | COMMENT |
| LOW | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 271 | // Step 0: Contrive some points | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 38 | // Step 1: Select four points arbitrarily to form the initial simplex (tetrahedron) | COMMENT |
| LOW | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 90 | // Step 1: Check if our latest point is outside of the hull | COMMENT |
| LOW⚡ | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 103 | // Step 2: Clean the way for ourselves (Resets the "isFacing" sentinels on the Vertices) | COMMENT |
| LOW⚡ | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 106 | // Step 3: Mark all the vertices on the horizon | COMMENT |
| LOW⚡ | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 115 | // Step 4: Remind each vertex what its original index was (foreshadowing!) | COMMENT |
| LOW⚡ | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 119 | // Step 5: Sort the horizon vertices clockwise about the point-average-average axis | COMMENT |
| LOW | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 137 | // Step 6: Create new triangles around this horizon and call it good... | COMMENT |
| LOW | …tree-sitter-semgrep/lang/c-sharp/test/ok/ConvexHull.cs | 271 | // Step 0: Contrive some points | COMMENT |
| LOW | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 38 | // Step 1: Select four points arbitrarily to form the initial simplex (tetrahedron) | COMMENT |
| LOW | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 90 | // Step 1: Check if our latest point is outside of the hull | COMMENT |
| LOW⚡ | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 103 | // Step 2: Clean the way for ourselves (Resets the "isFacing" sentinels on the Vertices) | COMMENT |
| LOW⚡ | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 106 | // Step 3: Mark all the vertices on the horizon | COMMENT |
| LOW⚡ | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 115 | // Step 4: Remind each vertex what its original index was (foreshadowing!) | COMMENT |
| LOW⚡ | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 119 | // Step 5: Sort the horizon vertices clockwise about the point-average-average axis | COMMENT |
| LOW | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 137 | // Step 6: Create new triangles around this horizon and call it good... | COMMENT |
| LOW | …-sitter-semgrep/lang/c-sharp-pro/test/ok/ConvexHull.cs | 271 | // Step 0: Contrive some points | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | cli/tests/default/unit/test_yaml_parsing.py | 0 | rules: - id: rule_id pattern: | $x == $x $y == $y languages: [python] severity: info message: bad | STRING |
| HIGH | cli/tests/default/unit/test_rule_match.py | 0 | rules: - id: rule_id pattern: | $x == $x $y == $y languages: [python] severity: info message: bad | STRING |
| HIGH | cli/tests/default/unit/test_match_hashes.py | 0 | rules: - id: rule_id pattern: | $x == $x $y == $y languages: [python] severity: info message: bad | STRING |
| HIGH | …lt/e2e/targets/autofix/django-none-password-default.py | 0 | creates and saves a poster with the given email and password. | STRING |
| HIGH | …o-none-password-default.py-text-not-dryrun/results.txt | 0 | creates and saves a poster with the given email and password. | STRING |
| HIGH | …jango-none-password-default.py-text-dryrun/results.txt | 0 | creates and saves a poster with the given email and password. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | cli/tests/default/unit/parsers/test_maven_install.py | 467 | """A valid JSON document whose root is not an object (array, scalar, null) | STRING |
| HIGH⚡ | cli/tests/default/e2e-other/parsers/test_swiftpm.py | 342 | "branch": null, | STRING |
| HIGH⚡ | cli/tests/default/e2e-other/parsers/test_swiftpm.py | 351 | "branch": null, | STRING |
| HIGH⚡ | cli/tests/default/e2e-other/parsers/test_swiftpm.py | 360 | "branch": null, | STRING |
| HIGH | cli/src/semgrep/mcp/server.py | 1203 | - Run: `semgrep install-semgrep-pro || true` | CODE |
| HIGH | cli/src/semgrep/mcp/hooks/post_tool.py | 43 | # "decision": "block"|undefined, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/tests/default/mcp/test_create_temp_files.py | 40 | # Check if temp directory was created | COMMENT |
| LOW | cli/tests/default/mcp/test_create_temp_files.py | 44 | # Check if files were created with correct content | COMMENT |
| LOW | cli/tests/default/mcp/test_create_temp_files.py | 71 | # Check if temp directory was created | COMMENT |
| LOW | cli/tests/default/mcp/test_create_temp_files.py | 101 | # Check if temp directory was created | COMMENT |
| LOW | cli/tests/default/e2e-other/test_ci.py | 3456 | # Check if we should mimic an existing settings file via simulation | COMMENT |
| LOW | cli/src/semdep/golang_version.py | 155 | ): # Check if anything exists after the core version spec | CODE |
| LOW | cli/src/semdep/golang_version.py | 251 | # Check if the identifier is a number | COMMENT |
| LOW | cli/src/semdep/matchers/pip_requirements.py | 127 | # Check if the lockfile is in a 'requirements' directory | COMMENT |
| LOW | cli/src/semgrep/scan_report.py | 532 | # Check if any secret rule has the generic secrets AI ruleset | COMMENT |
| LOW | cli/src/semgrep/main.py | 95 | # Check if any of the exclusionary commands are provided | COMMENT |
| LOW | cli/src/semgrep/mcp/server.py | 214 | # Check if normalized path is still absolute | COMMENT |
| LOW | …bs/ocaml-tree-sitter-semgrep/lang/ruby/test/ok/poly.rb | 74 | # Assign exponents to each term, making pairs of coeff and exponent, | COMMENT |
| LOW | .github/workflows/sync-with-PRO.yml | 67 | # Check if any commits are already synced from Pro | COMMENT |
| LOW | src/main/flags.sh | 46 | # Check if SEMGREP_NIX_BUILD is not set | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/patterns/js/dots_stmts.js | 5 | print("do stuff"); | CODE |
| HIGH | tests/patterns/js/deep_exprstmt.js | 10 | print(bar()); | CODE |
| HIGH | tests/patterns/ts/deep_exprstmt.ts | 10 | print(bar()); | CODE |
| HIGH | tests/patterns/ts/dots_stmts.ts | 5 | print("do stuff"); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/tainting_rules/python/simpl_django_redirect.py | 36 | CODE | |
| LOW | tests/rules/metavar_pattern_open_redirect.py | 52 | CODE | |
| LOW | tests/rules/sym_prop_open_redirect.py | 52 | CODE | |
| LOW | tests/perf/timeout.py | 70 | CODE | |
| LOW | tests/perf/force_timeout.py | 70 | CODE | |
| LOW | tests/perf/timeout_gracefully.py | 66 | CODE | |
| LOW | cli/tests/conftest.py | 425 | CODE | |
| LOW | cli/tests/fixtures.py | 48 | CODE | |
| LOW | cli/tests/default/e2e-other/test_ci.py | 3725 | CODE | |
| LOW | cli/tests/default/e2e-other/test_ci.py | 3921 | CODE | |
| LOW | …tests/default/e2e/targets/equivalence/open_redirect.py | 66 | CODE | |
| LOW | cli/tests/default/e2e/targets/test_test/long.py | 66 | CODE | |
| LOW | cli/src/semgrep/rule_match.py | 576 | CODE | |
| LOW | cli/src/semgrep/core_runner.py | 609 | CODE | |
| LOW | cli/src/semgrep/run_scan.py | 1049 | CODE | |
| LOW | cli/src/semgrep/run_scan.py | 1276 | CODE | |
| LOW | cli/src/semgrep/output.py | 414 | CODE | |
| LOW | cli/src/semgrep/mcp/server.py | 631 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/parsing/cpp/operator_templated3.cpp | 7 | :: don't forget to update hdf5_daa_layer.cu accordingly | CODE |
| LOW | cli/tests/conftest.py | 501 | # so make sure to explicitly delete any ambient CI variables. | COMMENT |
| LOW | cli/tests/default/e2e/test_permissions.py | 90 | # We make sure to not run as root since it can read files lacking | COMMENT |
| MEDIUM | …default/e2e/targets/dependency_aware/dart/pubspec.yaml | 70 | # included with your application, so that you can use the icons in | COMMENT |
| MEDIUM | cli/src/semgrep/console_scripts/entrypoint.py | 39 | # alt: you can also add '-W ignore::DeprecationWarning' after the python3 above, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | cli/src/semdep/parsers/pnpm.py | 414 | Parses the dependencies of a package in a `pnpm-lock.yaml` file (version >=9.0). In pnpm-lock.yaml files versi | STRING |
| HIGH | cli/src/semgrep/mcp/server.py | 242 | Creates temporary files from code content Args: code_files: List of CodeFile objects Returns: | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 134 | - [Semgrep Code (SAST)](https://semgrep.dev/products/semgrep-code?utm_medium=readme&utm_source=github&utm_content=semg | CODE |
| MEDIUM | cli/README.md | 134 | - [Semgrep Code (SAST)](https://semgrep.dev/products/semgrep-code?utm_medium=readme&utm_source=github&utm_content=semg | CODE |
| MEDIUM⚡ | cli/tests/default/unit/test_scans_v2.py | 175 | # POST-retry orchestration tests (mock _poll_for_config_v2 directly) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/naming/python/scope.py | 13 | CODE | |
| MEDIUM | tests/naming/python/scope.py | 14 | CODE | |
| MEDIUM | tests/rules/taint_exception.py | 8 | CODE | |
| MEDIUM | tests/rules/taint_exception.py | 53 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/src/semdep/external/packaging/tags.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | cli/src/semdep/external/packaging/version.py | 14 | __all__ = ["parse", "Version", "LegacyVersion", "InvalidVersion", "VERSION_PATTERN"] | CODE |
| LOW | cli/src/semdep/external/packaging/__init__.py | 16 | __all__ = [ | CODE |
| LOW | cli/src/semdep/external/packaging/__about__.py | 5 | __all__ = [ | CODE |
| LOW | cli/src/semgrep/telemetry.py | 274 | def update_attributes(self, new_attrs: Attributes) -> None: | CODE |
| LOW | cli/src/semgrep/app/auth.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | cli/src/semgrep/app/auth.py | 94 | def set_token(token: str) -> None: | CODE |
| LOW | …grep/semgrep_interfaces/scripts/jsonschema2protobuf.py | 19 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | cli/tests/default/unit/test_paths_to_transitivity.py | 106 | This entire paragraph was pretty much generated by Copilot wow | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/src/semgrep/mcp/hooks/inject_secure_defaults.py | 207 | # TODO: implement this hook for Windsurf | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/generate_cheatsheet.py | 5 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/rules/taint_clean_in_try_no_finally.py | 1 | def test_function(): | CODE |