security/semgrep
Runs the Semgrep packs of each configuration, and the repository rules, over changed files.
Part of the security configuration, at the recommended level. It runs at the push stage, per file. It runs semgrep.
An injection or a logged secret reads like ordinary code, and a pattern rule finds it before a reviewer has to.
What to do
Section titled “What to do”Change the code the way the message says. Turn one rule off for a path with gspot ignore security/semgrep --rule <id> --paths <glob> --reason "<why>".
Example
Section titled “Example”eval(userInput) matches a rule against dynamic evaluation and reports its ID and location. Parse the input instead, and allow only known operations.
Turn it off
Section titled “Turn it off”Turn it off for some files, or one of its lint rules, with a reason:
gspot ignore security/semgrep --paths "<glob>" --reason "<why>"gspot ignore security/semgrep --rule <rule> --reason "<why>"A suppression comment is refused; use gspot ignore.