becojo/semsearch

# semsearch 用于创建和运行 Opengrep 规则的 CLI 接口，能够处理比原始 Semgrep CLI 更复杂的场景。 ``` Usage: semsearch [options] Pattern options: -l --language Add a language to the rule (default: generic) -p --pattern Pattern to match -pi --pattern-inside Pattern to match inside the matched pattern -pni --pattern-not-inside Pattern to match not inside the matched pattern -pr --pattern-regex Pattern to match using a regex -pnr --pattern-not-regex Pattern to match not using a regex -mr --metavariable-regex Metavariable to match using a regex -fm --focus-metavariable Metavariable name to focus on Pattern group options: -ps --patterns [...] Start a pattern group where all patterns must match -pe --pattern-either [...] Start a pattern group where any pattern may match -mp --metavariable-pattern [...] Start a pattern group to match a metavariable -psk --pattern-sinks [...] Set the pattern sinks for the current rule -pso --pattern-sources [...] Set the pattern sources for the current rule ^ --pop Exit the current pattern group Search options: -i --path Add the path to the search -e --eval Evaluate the rule on the given string Rule options: -m --message Message to display -fx --fix Fix pattern -fr --fix-regex Fix pattern using a regex -af --autofix Automatically write fixes --id Rule ID --metadata Add metadata to the rule --severity Set the severity of the rule --option Set an option for the rule (such as: generic_ellipsis_max_span) --path-include Limit the search to the specified path --path-exclude Exclude the specified path from the search --rule Start a new rule Run options: -f --format Output format (json, text, sarif, vim, emacs) -c --config Add additional rules --debug Output semsearch debug information --verbose Enable Opengrep verbose mode --export Output the rule instead of running Opengrep --taint-intrafile Enable Opengrep intrafile taint analysis Shell completion: --bash-completion Output bash completion script ``` ## 示例 列出此代码库中使用的官方 GitHub Actions： ``` semsearch -l yaml -p 'uses: "$USES"' -mr 'USES=actions' --path-include .github/workflows ``` ``` .github/workflows/ci.yml ❯❱ rule-1 20┆ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 ⋮┆---------------------------------------- 23┆ - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 ``` 输出上面使用的 YAML 规则而不是运行它： ``` semsearch -l yaml -p 'uses: "$USES"' -mr 'USES=actions' --export ``` ``` rules: - id: rule-1 severity: WARNING message: "" languages: - yaml paths: include: - .github/workflows patterns: - pattern: 'uses: "$USES"' - metavariable-regex: metavariable: $USES regex: actions ``` ## 安装说明 下载[最新版本](https://github.com/becojo/semsearch/releases)或使用 `go install` 安装： ``` go install github.com/becojo/semsearch/cmd/semsearch@latest ```

标签：AST解析, EVTX分析, Linux安全, 代码搜索, 日志审计, 错误基检测, 静态代码分析