Detect complex code patterns using semantic grep

Learn how to uncover security bugs by detecting complex or unwanted code patterns through a familiar, grep-like syntax.

Redpoint Ventures

We’ll discuss a program analysis tool we’re developing called sgrep. It&#x27;s a multi-lingual semantic &quot;grep-style&quot; tool for writing AST and dataflow-aware queries on source code (for Python, Java, Go, C, and JS). The original author, Yoann Padioleau, worked on the tool for Facebook and is now fulltime at <a href="https://r2c.dev" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">r2c</a>. sgrep is the query system underpinning <a href="https://bento.dev/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Bento</a>, a free open-source program analysis toolkit that finds bugs using custom analysis we’ve written and OSS code checks. Bento is ideal for security researchers, product security engineers, and developers who want to find complex code patterns without extensive knowledge of ASTs or advanced program analysis concepts.For example, find subprocess calls with shell=True in Python using the query subprocess.open(..., shell=True). This will even find snippets like import subprocess as s; s.open(f‘rm {args}’, shell=True). Or find hardcoded credentials using the query boto3.client(..., aws_secret_access_key=”...”, aws_access_key_id=”...” ).The meetup is at 5:30PM on Mon, Feb 10 at 21 South Park Street in San Francisco. Feel free to attend or forward to interested friends!

Our {communityGuidelinesLink} describe the sort of content we prohibit on Eventbrite. If you suspect an event may be in violation, you can report it to us so we can investigate.

To report other categories of prohibited or illegal content, submit {link}

Detect complex code patterns using semantic grep

More events from r2c

Discover more events from r2c, from Science & Tech to other experiences you might love.

Detect complex code patterns using semantic grep

More events from r2c

Discover more events from r2c, from Science & Tech to other experiences you might love.

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.