semgrep.yml

# See pfff/semgrep.yml for more information.
# Put semgrep-specific rules here. More general OCaml or Python rules should
# go in the semgrep-rules repository under ocaml/ or python/.

rules:
  - id: no-print-in-semgrep
    patterns:
      - pattern-either:
          - pattern: pr ...
      - pattern-not-inside: |
          if !Flag.debug
          then ...
      - pattern-not-inside: |
          let $F ... =
             ...
          [@@action]
    message: you should not print anything on stdout as it may interfere with
      the JSON output we must return to the semgrep python wrapper.
    languages: [ocaml]
    severity: ERROR
    paths:
      exclude:
        - cli/*.ml
        - scripts/*
        - Test.ml
        - Matching_report.ml
        - Unit_*.ml
        - Test_*.ml
        - runner/*.ml
        - experiments/*
        - Check_*.ml

  - id: not-using-our-pcre-wrappers
    patterns:
      - pattern-either:
          - pattern: Pcre.regexp
          - pattern: Pcre.pmatch
          - pattern: Pcre.exec
          - pattern: Pcre.exec_all
          - pattern: Pcre.split
    message: >-
      You should use one of the equivalent functions in SPcre, which
      automatically sets some flags and handles exceptions.
    languages: [ocaml]
    severity: ERROR
    paths:
      exclude:
        - SPcre.ml

  - id: no-list-map
    pattern: List.map
    message: >-
      `List.map` creates O(N) stack depth, and can lead to a
      stack overflow. Use `Common.map` instead.
    fix: Common.map
    languages: [ocaml]
    severity: ERROR
    paths:
      include:
        - semgrep-core/src/*

  - id: use-concat-map
    pattern-either:
      - pattern: List.map ... |> List.flatten
      - pattern: Common.map ... |> List.flatten
      - pattern: List.map ... |> List.concat
      - pattern: Common.map ... |> List.concat
      - pattern: List.flatten ( List.map ... )
      - pattern: List.flatten ( Common.map ... )
      - pattern: List.concat ( List.map ... )
      - pattern: List.concat ( Common.map ... )
    message: >-
      `List.concat_map` is more efficient and more readable than a `map` followed
      by `concat`.
    languages: [ocaml]
    severity: ERROR
    paths:
      include:
        - semgrep-core/src/*

  - id: no-exit-code-1-in-semgrep
    pattern: sys.exit(1)
    fix: sys.exit(2)
    message: >-
      Exit code 1 is reserved for notifying users that blocking findings were found.
      Please use a different exit code, or better yet, a SemgrepError exception.
      For generic fatal errors, we use exit code 2.
    languages: [python]
    severity: ERROR
    paths:
      include:
        - semgrep/semgrep/*
# not ready yet
#  - id: no-exit-in-semgrep
#    pattern: |
#      exit $X
#    message: do not use directly exit. raise instead UnixExit $X
#    languages: [ocaml]
#    severity: ERROR