semgrep

import subprocess import json import os # Create a dummy Python file to scan for demonstration dummy_code = """ import os def vulnerable_function(user_input): # This pattern (os.system with user input) is often flagged by security rules os.system(f"echo {user_input}") def harmless_function(): print("Hello, Semgrep!") """ file_path = "vulnerable_app.py" with open(file_path, "w") as f: f.write(dummy_code) print(f"Created {file_path} for scanning.") try: # Run Semgrep scan on the dummy file with a common security ruleset # Use --json for machine-readable output and --error to get a non-zero exit code on findings # `check=False` is used to allow inspection of output even if Semgrep exits with findings (code 1) result = subprocess.run( ["semgrep", "scan", "--config", "p/security-audit", file_path, "--json", "--error"], capture_output=True, text=True, check=False ) print("\n--- Semgrep CLI Output (stdout) ---") print(result.stdout) if result.stderr: print("\n--- Semgrep CLI Error (stderr) ---") print(result.stderr) if result.returncode != 0: print(f"\nSemgrep exited with non-zero code: {result.returncode}. This indicates findings or an actual error.") else: print("\nSemgrep exited with code 0. No findings or --error was not used/no blocking rules.") # Parse JSON output if available try: json_output = json.loads(result.stdout) if json_output.get("results"): print(f"\nFound {len(json_output['results'])} security findings:") for finding in json_output["results"]: print(f" - Rule: {finding['check_id']} at {finding['start']['line']}:{finding['start']['col']}") print(f" Message: {finding['extra']['message']}") else: print("\nNo findings reported in JSON output.") except json.JSONDecodeError: print("\nCould not decode JSON output.") except FileNotFoundError: print("Error: 'semgrep' command not found. Please ensure Semgrep is installed and in your PATH.") except Exception as e: print(f"An unexpected error occurred: {e}") finally: # Clean up the dummy file if os.path.exists(file_path): os.remove(file_path) print(f"\nCleaned up {file_path}.")