Free readiness test
Home / Tool labs / Semgrep

Semgrep hands-on lab Review the orders service before release

Find security bugs in source code with fast, readable rules.

DevSecOpsIntermediatePro live lab4 objectives
dev@laptop:~/orders$
$ cat src/routes/orders.js
const express = require("express");
const router = express.Router();
const db = require("../db");

// GET /api/orders?id=123
router.get("/", async (req, res) => {
  // TODO: auth check
  const rows = await db.query("SELECT * FROM orders WHERE id = '" + req.query.id + "'");
  res.json(rows);

What is Semgrep?

Semgrep is a fast static analysis (SAST) tool. Rules look like the code they match, so developers can read them and security teams can write custom rules for their own frameworks.

1 SAST

Analyses source code without running it, catching flaws like SQL injection before deployment.

2 Rulesets

Community packs such as p/owasp-top-ten and p/secrets cover common issues.

3 Custom rules

A few lines of YAML encode your team's own secure-coding standards.

The scenario: Review the orders service before release

The orders Node.js service is about to go live. Run Semgrep against src/, read the riskiest finding in the code, enforce a custom team rule, and produce SARIF output for GitHub code scanning.

Run this lab live in the platform

A simulated terminal with 4 objectives, hints and scenario questions. Included with NERvE Pro.

Open the Semgrep lab

Step-by-step: Semgrep commands used in this lab

1Scan the source with the OWASP Top 10 ruleset

--config p/owasp-top-ten

semgrep --config p/owasp-top-ten src/

2Read the vulnerable code

cat the file from the first finding.

cat src/routes/orders.js

3Run the team's custom rule

--config rules/no-raw-sql.yml

semgrep --config rules/no-raw-sql.yml src/

4Export SARIF for GitHub code scanning

--sarif --output

semgrep --config p/owasp-top-ten --sarif --output semgrep.sarif src/

Key takeaways

Install Semgrep and practise for real

pipx install semgrep   # then: semgrep --config p/owasp-top-ten .

Run it on an intentionally vulnerable app like OWASP Juice Shop's source code. Only scan or test systems you own or are explicitly authorised to assess. Official site: semgrep.dev · Licence: LGPL 2.1 (CE).

Scenario questions

What's the correct fix for the orders.js finding?

Answer: Use a parameterised query and check the order belongs to the user. Parameterised queries stop injection; the ownership check fixes the IDOR.

Why write custom Semgrep rules?

Answer: To enforce your own frameworks and standards and catch patterns generic rules miss. Custom rules encode team-specific knowledge, as the reports.js finding shows.

Where does SARIF output help?

Answer: Showing findings as annotations in GitHub/GitLab pull requests. SARIF is the standard format code-scanning UIs understand.

More open-source tool labs

🐳

Trivy

Scan container images, code and Kubernetes manifests for vulnerabilities and misconfigurations.

🔑

Gitleaks

Find passwords, keys and tokens committed to Git, then stop it happening again.

☁️

Checkov

Catch cloud misconfigurations in Terraform before they're deployed.

📡

Nmap

Discover hosts, open ports and services on networks you're authorised to assess.

🦈

Wireshark / tshark

See exactly what's crossing the wire and spot malware calling home.

🔭

Zeek

Turn raw traffic into rich, searchable logs for threat hunting.