Open Gby56 opened 4 months ago
My bad, I just noticed you talk about Interprocedural in your paper, I think that's what it is, my use-case for inter-file (as semgrep calls it) is to be able to really track down the request parameters, and the response structure, to generate accurate OpenAPI Specifications.
Hey!
Yup, interprocedural / interfile analysis is something route-detect
is currently weak at. I think Semgrep's interprocedural support could help, but as you mentioned, it's Pro-only, and I haven't had a chance to test it out. There are a few common web application framework patterns that route-detect
has problems detecting authn/authz information:
--interprocedural
flag here:--global
flag here:Most generally, all these cases fall under interprocedural or interfile issues. Generally Semgrep is weak in this situation, and something like CodeQL would be much stronger. However, CodeQL is significantly more difficult to use, and it'd take quite a long time to get the equivalent level of web application framework coverage that route-detect
currently has.
Hey ! Just wondering if you had the problem of performing the detection cross-file ? Like, one index file, and many controller files with functions declared there to handle your request, parameters, response etc... I know there are not a lot of tools doing that properly for now, Noir is purely regex based and not able to do it cross-file.
Here with semgrep I'm guessing you're limited with the
interfile
feature that is for the pro engine only ?