Opengrep quickstart
Since I could not find a quickstart to run opengrep with the full set of rules from their fork I thought I'd document what I found out.
Setup
Download the opengrep binary from github and make it executable with chmod +x.
Clone the rules repo:
git clone git@github.com:opengrep/opengrep-rules.git
and clean it up to make it usable to opengrep:
cd opengrep-rules
rm -rf ".git",".github",".pre-commit-config.yaml", "elixir", "apex"
find . -type f -not -iname "*.yaml" -delete
rm -rf .github
rm -rf .pre-commit-config.yaml
Ensure opengrep can load the rules with:
opengrep_manylinux_x86 validate .
The same can be done for custom rules maintained in a separate repository. AFAIU Multiple repositories can be specified by repeating -f option as needed, see below.
We are now ready to scan a repo, from the repo root directory run:
opengrep_manylinux_x86 scan \
-f <path_to>/opengrep-rules \
--error \
--exclude-rule=VAL
some tips:
- to save time you can load only the rules that apply to a specific project, for example only load java rules and ignore everything else by repeating -f with specific subdirectories
- output can redirected to a file in a specific format for later inspection, loading into defectdojo or archival with --text-* options
- --exclude-rules can be used to disable rules and can be repeated as many times as necessary
- --error forces opengrep to exit with 1 if there are any findings, useful for CI
- --include and --exclude can be used to exclude files and directories that are not relevant
Run opengrep --help to see all options.
Running opengrep against recent changes only
We can gather a list of changed files (in this case files changed less than 72h ago) and supply that list to opengrep with some bash magic:
find . \
-type f \
-atime -72 \
-print0 \
| xargs \
--no-run-if-empty \
-0 <opegrep command>
Note that if the list becomes longer than 1024 files approx., xargs will start another opengrep process after the first one.