Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MASTG-TOOL-0110] Add semgrep #2871

Merged
merged 2 commits into from
Aug 8, 2024
Merged

[MASTG-TOOL-0110] Add semgrep #2871

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e59d29f
add semgrep
cpholguera Aug 8, 2024
6780a79
update references to @MASTG-TOOL-0110
cpholguera Aug 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion demos/android/MASVS-CRYPTO/MASTG-DEMO-0007/MASTG-DEMO-0007.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ test: MASTG-TEST-0204

### Steps

Let's run our semgrep rule against the sample code.
Let's run our @MASTG-TOOL-0110 rule against the sample code.

{{ ../../../../rules/mastg-android-insecure-random-use.yaml }}

Expand Down
2 changes: 1 addition & 1 deletion demos/android/MASVS-CRYPTO/MASTG-DEMO-0008/MASTG-DEMO-0008.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ test: MASTG-TEST-0205

### Steps

Let's run our semgrep rule against the sample code.
Let's run our @MASTG-TOOL-0110 rule against the sample code.

{{ ../../../../rules/mastg-android-non-random-use.yaml }}

Expand Down
2 changes: 1 addition & 1 deletion demos/android/MASVS-STORAGE/MASTG-DEMO-0003/MASTG-DEMO-0003.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ This requires special app access called ["All files access"](https://developer.a

### Steps

Let's run our semgrep rule against the reversed java code.
Let's run our @MASTG-TOOL-0110 rule against the reversed java code.

{{ ../../../../rules/mastg-android-data-unencrypted-shared-storage-no-user-interaction-apis.yml }}

Expand Down
2 changes: 1 addition & 1 deletion demos/android/MASVS-STORAGE/MASTG-DEMO-0004/MASTG-DEMO-0004.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ The snippet below shows sample code that creates a file in external storage usin

### Steps

Let's run our semgrep rule against the reversed java code.
Let's run our @MASTG-TOOL-0110 rule against the reversed java code.

{{ ../../../../rules/mastg-android-data-unencrypted-shared-storage-no-user-interaction-apis.yml }}

Expand Down
2 changes: 1 addition & 1 deletion demos/android/MASVS-STORAGE/MASTG-DEMO-0005/MASTG-DEMO-0005.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ The snippet below shows sample code that uses the `MediaStore` API to write a fi

### Steps

Let's run our semgrep rule against the sample code.
Let's run our @MASTG-TOOL-0110 rule against the sample code.

{{ ../../../../rules/mastg-android-data-unencrypted-shared-storage-no-user-interaction-apis.yml }}

Expand Down
2 changes: 1 addition & 1 deletion techniques/android/MASTG-TECH-0014.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ platform: android

Static analysis is a technique used to examine and evaluate the source code of a mobile application without executing it. This method is instrumental in identifying potential security vulnerabilities, coding errors, and compliance issues. Static analysis tools can scan the entire codebase automatically, making them a valuable asset for developers and security auditors.

Two good examples of static analysis tools are grep and [semgrep](https://semgrep.dev/). However, there are many other tools available, and you should choose the one that best fits your needs.
Two good examples of static analysis tools are grep and @MASTG-TOOL-0110. However, there are many other tools available, and you should choose the one that best fits your needs.

## Example: Using grep for Manifest Analysis in Android Apps

Expand Down
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,4 +30,4 @@ The output should contain a network traffic sensitive data log that includes the

The test case fails if you can find the sensitive data you entered in the app that is not stated in the App Store Privacy declarations.

Note that this test does not provide any code locations where the sensitive data is being sent over the network. In order to identify the code locations, you can use static analysis tools like [semgrep](https://semgrep.dev/) or dynamic analysis tools like @MASTG-TOOL-0031.
Note that this test does not provide any code locations where the sensitive data is being sent over the network. In order to identify the code locations, you can use static analysis tools like @MASTG-TOOL-0110 or dynamic analysis tools like @MASTG-TOOL-0031.
7 changes: 7 additions & 0 deletions tools/generic/MASTG-TOOL-0110.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
---
title: semgrep
platform: generic
source: https://github.com/semgrep/semgrep
---

[semgrep](https://github.com/semgrep/semgrep) is a static code scanner that is able to scan Java, Kotlin and Swift.
Loading