Skip to content

Commit 2ed0516

Browse files
quekshuyquekshuy
authored
Run semgrep scan with community edition on every PR (#22)
* Run semgrep scan with community edition on every PR * Rename github action workflow * Fix indentation * Fix more issues * Remove sonarqube github workflow
1 parent 547735e commit 2ed0516

3 files changed

Lines changed: 182 additions & 20 deletions

File tree

‎.github/workflows/build_ts.yml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎.github/workflows/semgrep_scan.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Scan with Semgrep CE
2+
on:
3+
push:
4+
branches:
5+
- master
6+
pull_request:
7+
types: [opened, synchronize, reopened]
8+
jobs:
9+
semgrep:
10+
# User definable name of this GitHub Actions job.
11+
name: semgrep-oss/scan
12+
# If you are self-hosting, change the following `runs-on` value:
13+
runs-on: ubuntu-latest
14+
15+
container:
16+
# A Docker image with Semgrep installed. Do not change this.
17+
image: semgrep/semgrep
18+
19+
# Skip any PR created by dependabot to avoid permission issues:
20+
if: (github.actor != 'dependabot[bot]')
21+
22+
steps:
23+
# Fetch project source with GitHub Actions Checkout. Use either v3 or v4.
24+
- uses: actions/checkout@v4
25+
- name: Run Semgrep scan
26+
run: |
27+
semgrep scan --config auto --config ./.semgrep_scan_rules.yml \
28+
--sarif --output=semgrep.sarif || true
29+
- name: Upload SARIF file
30+
uses: github/codeql-action/upload-sarif@v3
31+
with:
32+
sarif_file: semgrep.sarif
33+
if: always()

‎.semgrep_scan_rules.yml‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
rules:
2+
# JavaScript/TypeScript Security Rules
3+
- id: react-native-hardcoded-secrets
4+
pattern-either:
5+
- pattern: |
6+
const $VAR = "$SECRET"
7+
- pattern: |
8+
let $VAR = "$SECRET"
9+
- pattern: |
10+
var $VAR = "$SECRET"
11+
metavariable-regex:
12+
metavariable: $SECRET
13+
regex: (?i)(password|secret|key|token|api_key|apikey|auth)
14+
message: "Potential hardcoded secret found"
15+
languages: [javascript, typescript]
16+
severity: ERROR
17+
18+
- id: react-native-unsafe-require
19+
pattern: require($PATH)
20+
metavariable-regex:
21+
metavariable: $PATH
22+
regex: ^[^"']*\$
23+
message: "Dynamic require() calls can be dangerous"
24+
languages: [javascript, typescript]
25+
severity: WARNING
26+
27+
# Java Android Security Rules
28+
- id: android-external-storage-usage
29+
pattern-either:
30+
- pattern: Environment.getExternalStorageDirectory()
31+
- pattern: Environment.getExternalStoragePublicDirectory($DIR)
32+
message: "External storage access detected - ensure proper permissions"
33+
languages: [java]
34+
severity: INFO
35+
36+
- id: android-logging-sensitive-data
37+
pattern-either:
38+
- pattern: Log.d($TAG, $MSG)
39+
- pattern: Log.v($TAG, $MSG)
40+
- pattern: Log.i($TAG, $MSG)
41+
- pattern: Log.w($TAG, $MSG)
42+
- pattern: Log.e($TAG, $MSG)
43+
metavariable-regex:
44+
metavariable: $MSG
45+
regex: (?i).*(password|secret|key|token|credential).*
46+
message: "Potential sensitive data in log statement"
47+
languages: [java]
48+
severity: ERROR
49+
50+
- id: android-file-permissions
51+
pattern-either:
52+
- pattern: new FileOutputStream($FILE)
53+
- pattern: new FileInputStream($FILE)
54+
message: "File I/O operation - verify proper permissions and validation"
55+
languages: [java]
56+
severity: INFO
57+
58+
# Objective-C iOS Security Rules
59+
- id: ios-nslog-sensitive-data
60+
pattern: NSLog($FORMAT, ...)
61+
metavariable-regex:
62+
metavariable: $FORMAT
63+
regex: (?i).*(password|secret|key|token|credential).*
64+
message: "Potential sensitive data in NSLog statement"
65+
languages: [objc]
66+
severity: ERROR
67+
68+
- id: ios-file-manager-usage
69+
pattern-either:
70+
- pattern: |
71+
[[NSFileManager defaultManager] $METHOD:...]
72+
- pattern: |
73+
[NSFileManager.defaultManager $METHOD:...]
74+
message: "File manager usage detected - ensure proper file handling"
75+
languages: [objc]
76+
severity: INFO
77+
78+
# General Cross-Platform Rules
79+
- id: potential-command-injection
80+
pattern-either:
81+
- pattern: Runtime.getRuntime().exec($CMD)
82+
- pattern: ProcessBuilder($CMD)
83+
- pattern: system($CMD)
84+
message: "Potential command injection vulnerability"
85+
languages: [java, objc]
86+
severity: ERROR
87+
88+
- id: weak-crypto-usage
89+
pattern-either:
90+
- pattern: MD5
91+
- pattern: SHA1
92+
- pattern: DES
93+
message: "Weak cryptographic algorithm detected"
94+
languages: [java, objc, javascript, typescript]
95+
severity: WARNING
96+
97+
# React Native Specific Rules
98+
- id: react-native-bridge-exposure
99+
pattern-either:
100+
- pattern: |
101+
@ReactMethod
102+
public $RETURN_TYPE $METHOD_NAME(...) {
103+
...
104+
}
105+
- pattern: |
106+
RCT_EXPORT_METHOD($METHOD_NAME)
107+
message: "Native method exposed to JavaScript bridge - ensure proper validation"
108+
languages: [java, objc]
109+
severity: INFO
110+
111+
- id: react-native-unsafe-webview
112+
pattern-either:
113+
- pattern: |
114+
<WebView $PROPS />
115+
- pattern: |
116+
WebView($PROPS)
117+
message: "WebView usage detected - ensure secure configuration"
118+
languages: [javascript, typescript]
119+
severity: INFO
120+
121+
# Build Configuration Security
122+
- id: gradle-http-repository
123+
pattern-either:
124+
- pattern: |
125+
maven {
126+
url "http://..."
127+
}
128+
- pattern: |
129+
maven { url 'http://...' }
130+
message: "HTTP repository URL found - use HTTPS for security"
131+
languages: [gradle]
132+
severity: WARNING
133+
134+
# Configuration for file inclusion/exclusion
135+
paths:
136+
include:
137+
- "*.js"
138+
- "*.ts"
139+
- "*.tsx"
140+
- "*.java"
141+
- "*.m"
142+
- "*.h"
143+
- "*.gradle"
144+
- "build.gradle"
145+
exclude:
146+
- "node_modules/"
147+
- "build/"
148+
- "dist/"
149+
- ".git/"

0 commit comments

Comments
 (0)