sast-analysis

name	sast-analysis
description	Static Application Security Testing (SAST) for multi-language codebases. Uses Semgrep and language-specific tools to detect vulnerabilities across Python, JavaScript, TypeScript, Go, Java, and more.
allowed-tools	Read, Grep, Glob, Bash(semgrep:*), Bash(bandit:*), Bash(eslint:*), Bash(command:*), Bash(jq:*), Bash(cat:*)

SAST Analysis - Multi-Language Security Scanner

Static Application Security Testing (SAST) skill for comprehensive vulnerability detection across multiple programming languages.

---

Supported Languages

Language	Primary Tool	Fallback
Python	Semgrep + Bandit	Pattern matching
JavaScript/TypeScript	Semgrep + ESLint	Pattern matching
Go	Semgrep	Pattern matching
Java	Semgrep	Pattern matching
Ruby	Semgrep	Pattern matching
PHP	Semgrep	Pattern matching
C/C++	Semgrep	Pattern matching
All others	Semgrep auto-detect	Pattern matching

---

Prerequisites Check

ALWAYS run this check before analysis:

echo "=== SAST Tools Availability ==="
command -v semgrep >/dev/null 2>&1 && echo "OK: semgrep $(semgrep --version 2>/dev/null | head -1)" || echo "MISSING: semgrep (primary tool)"
command -v bandit >/dev/null 2>&1 && echo "OK: bandit (Python)" || echo "OPTIONAL: bandit (Python-specific)"
command -v eslint >/dev/null 2>&1 && echo "OK: eslint (JavaScript)" || echo "OPTIONAL: eslint (JS-specific)"
command -v jq >/dev/null 2>&1 && echo "OK: jq" || echo "OPTIONAL: jq (JSON formatting)"

Installation

# Semgrep (required - supports all languages)
pip install semgrep
# or: brew install semgrep

# Python-specific (optional)
pip install bandit

# JavaScript-specific (optional)
npm install -g eslint @eslint/js

---

Universal Scan: Semgrep Auto-Detect

Semgrep automatically detects languages and applies relevant rules:

# Auto-detect language and apply security rules (RECOMMENDED)
semgrep scan --config=auto . --json-output /tmp/semgrep-auto.json 2>/dev/null

# OWASP Top 10 rules (all languages)
semgrep scan --config=p/owasp-top-ten . --json-output /tmp/semgrep-owasp.json 2>/dev/null

# Security audit (comprehensive)
semgrep scan --config=p/security-audit . --json-output /tmp/semgrep-security.json 2>/dev/null

# Secure defaults (guardrails)
semgrep scan --config=p/secure-defaults . --json-output /tmp/semgrep-defaults.json 2>/dev/null

After each scan: Read the output file with the Read tool and analyze the JSON results. Key fields to extract: .results[].check_id, .results[].extra.severity, .results[].path, .results[].start.line, .results[].extra.message, .results[].extra.metadata.cwe.

---

Language-Specific Scans

Python (Django, Flask, FastAPI)

Semgrep has framework-native analysis for Python with 84% true positive rate for Django, Flask, FastAPI, and ~100 popular libraries.

# Comprehensive Python scan (Django + Flask + FastAPI)
semgrep scan \
  --config=p/python \
  --config=p/django \
  --config=p/flask \
  . --json-output /tmp/semgrep-python.json 2>/dev/null

# FastAPI-specific patterns (included in p/python with framework-native analysis)
# Semgrep automatically tracks implicit data flows in FastAPI
semgrep scan --config=auto . --json-output /tmp/semgrep-fastapi.json 2>/dev/null

# Bandit for deeper Python-specific analysis
bandit -r . -f json -o /tmp/bandit-results.json 2>/dev/null

After each scan: Read the output file with the Read tool. For bandit, key fields: .results[].issue_severity, .results[].filename, .results[].line_number, .results[].test_id, .results[].issue_text, .results[].issue_cwe.id.

JavaScript / TypeScript

# JS/TS + React + Node.js rules
semgrep scan \
  --config=p/javascript \
  --config=p/typescript \
  --config=p/react \
  --config=p/nodejs \
  . --json-output /tmp/semgrep-js.json 2>/dev/null

# ESLint security plugin
eslint --ext .js,.jsx,.ts,.tsx . --format json -o /tmp/eslint-security.json 2>/dev/null

After each scan: Read the output file with the Read tool and analyze the JSON results.

Go

# Go security rules
semgrep scan --config=p/golang . --json-output /tmp/semgrep-go.json 2>/dev/null

After scan: Read /tmp/semgrep-go.json with the Read tool and analyze the JSON results.

Java

# Java + Spring rules
semgrep scan --config=p/java --config=p/spring . --json-output /tmp/semgrep-java.json 2>/dev/null

After scan: Read /tmp/semgrep-java.json with the Read tool and analyze the JSON results.

Ruby

# Ruby + Rails rules
semgrep scan --config=p/ruby --config=p/rails . --json-output /tmp/semgrep-ruby.json 2>/dev/null

After scan: Read /tmp/semgrep-ruby.json with the Read tool and analyze the JSON results.

PHP

# PHP + Laravel/Symfony rules
semgrep scan --config=p/php . --json-output /tmp/semgrep-php.json 2>/dev/null

After scan: Read /tmp/semgrep-php.json with the Read tool and analyze the JSON results.

---

OWASP Top 10:2025 Coverage

Updated mapping for OWASP Top 10 2025:

ID	Category	CWEs	Semgrep Coverage
A01:2025	Broken Access Control	40	p/owasp-top-ten, p/security-audit
A02:2025	Security Misconfiguration	16	p/security-audit, p/secure-defaults
A03:2025	Software Supply Chain Failures (NEW)	5	Use dependency-scanning skill
A04:2025	Cryptographic Failures	32	p/security-audit
A05:2025	Injection (SQL, XSS, Command)	38	p/sql-injection, p/command-injection
A06:2025	Insecure Design	-	Manual review, threat modeling
A07:2025	Authentication Failures	36	p/jwt, framework configs
A08:2025	Software/Data Integrity Failures	-	p/security-audit
A09:2025	Logging & Alerting Failures	5	Manual review
A10:2025	Mishandling Exceptional Conditions (NEW)	24	Pattern matching, manual review

Comprehensive OWASP Scan

# Full OWASP 2025 coverage
semgrep scan \
  --config=p/owasp-top-ten \
  --config=p/security-audit \
  --config=p/sql-injection \
  --config=p/command-injection \
  --config=p/ssrf \
  --config=p/secure-defaults \
  . --json-output /tmp/semgrep-owasp-full.json 2>/dev/null

After scan: Read /tmp/semgrep-owasp-full.json with the Read tool and analyze the JSON results.

A10:2025 - Exceptional Conditions Patterns

New category for error handling vulnerabilities:

# Python: Empty except blocks, improper error handling
grep -rn "except:\s*pass\|except Exception:\s*pass" --include="*.py" .

# JavaScript: Swallowed errors
grep -rn "catch\s*(.*)\s*{\s*}\|catch\s*(.*)\s*{\s*//\|\.catch\(\(\)\s*=>" --include="*.js" --include="*.ts" .

# Go: Ignored errors
grep -rn "_, _ =\|_ :=.*err" --include="*.go" .

---

Fallback: Pattern-Based Analysis

When Semgrep is not available, use language-aware pattern matching:

Universal Patterns (All Languages)

# SQL Injection patterns
grep -rn "execute.*%\|execute.*format\|execute.*\+\|query.*\+\|SELECT.*\+\|INSERT.*\+" \
  --include="*.py" --include="*.js" --include="*.ts" --include="*.java" --include="*.php" --include="*.rb" .

# Command Injection patterns
grep -rn "system(\|exec(\|popen(\|shell_exec(\|passthru(" \
  --include="*.py" --include="*.js" --include="*.php" --include="*.rb" .

# Hardcoded secrets (generic)
grep -rn "password\s*=\s*['\"][^'\"]\+['\"]\\|api_key\s*=\s*['\"]" \
  --include="*.py" --include="*.js" --include="*.ts" --include="*.java" --include="*.go" .

Python-Specific Patterns

# Dangerous functions
grep -rn "pickle\.loads\|yaml\.load\|eval(\|exec(\|__import__" --include="*.py" .

# SQL Injection in Django/SQLAlchemy/FastAPI
grep -rn "\.raw(\|\.extra(\|RawSQL(\|execute.*f\"" --include="*.py" .

# FastAPI security issues
grep -rn "verify=False\|allow_origins=\[.\*.\]\|Depends(.*OAuth2" --include="*.py" .

# Insecure deserialization
grep -rn "marshal\.loads\|shelve\.open" --include="*.py" .

JavaScript/TypeScript Patterns

# DOM XSS
grep -rn "innerHTML\|outerHTML\|document\.write\|eval(" --include="*.js" --include="*.ts" --include="*.jsx" --include="*.tsx" .

# Prototype pollution
grep -rn "__proto__\|constructor\[" --include="*.js" --include="*.ts" .

# Dangerous requires
grep -rn "require(.*\+\|require(.*input" --include="*.js" --include="*.ts" .

Go Patterns

# SQL Injection
grep -rn "fmt\.Sprintf.*SELECT\|fmt\.Sprintf.*INSERT\|Exec(.*\+" --include="*.go" .

# Command Injection
grep -rn "exec\.Command(.*\+\|os\.exec" --include="*.go" .

Java Patterns

# SQL Injection
grep -rn "createQuery.*\+\|executeQuery.*\+" --include="*.java" .

# XXE
grep -rn "XMLInputFactory\|SAXParser\|DocumentBuilder" --include="*.java" .

# Deserialization
grep -rn "ObjectInputStream\|readObject(" --include="*.java" .

---

Report Format

Structured Output

{
  "scan_info": {
    "tool": "semgrep|bandit|eslint|pattern-match",
    "languages_detected": ["python", "javascript"],
    "files_scanned": 142,
    "timestamp": "2025-12-11T10:30:00Z"
  },
  "findings": [
    {
      "severity": "CRITICAL|HIGH|MEDIUM|LOW",
      "confidence": "HIGH|MEDIUM|LOW",
      "rule_id": "python.lang.security.audit.sqli",
      "language": "python",
      "cwe": "CWE-89",
      "owasp": "A05:2025",
      "file": "src/database.py",
      "line": 42,
      "code_snippet": "cursor.execute(f\"SELECT * FROM users WHERE id={user_id}\")",
      "message": "Possible SQL injection via string formatting",
      "remediation": "Use parameterized queries"
    }
  ],
  "summary": {
    "by_severity": {"critical": 1, "high": 3, "medium": 5, "low": 2},
    "by_language": {"python": 7, "javascript": 4},
    "by_owasp": {"A05:2025": 3, "A01:2025": 2},
    "total": 11
  }
}

Severity Classification

Severity	Action Required	SLA
CRITICAL	Block merge, fix immediately	Same day
HIGH	Fix before release	Within sprint
MEDIUM	Review and plan fix	Next sprint
LOW	Track for future	Backlog

---

Framework-Specific Rules

Python Frameworks

Framework	Semgrep Config	Key Vulnerabilities
Django	p/django	XSS, CSRF, SQL injection, ORM bypass
Flask	p/flask	Session security, SSTI, debug mode
FastAPI	p/python (native support)	Input validation, OAuth2, CORS

JavaScript Frameworks

Framework	Semgrep Config	Key Vulnerabilities
React	p/react	XSS, dangerouslySetInnerHTML
Express	p/nodejs	Injection, auth bypass
Next.js	p/nextjs	SSRF, API routes

Other Frameworks

Framework	Semgrep Config	Key Vulnerabilities
Spring	p/spring	SpEL injection, auth
Rails	p/rails	Mass assignment, XSS
Laravel	p/php	SQL injection, CSRF

---

CI/CD Integration Examples

GitHub Actions

# .github/workflows/sast.yml
name: SAST Security Scan
on:
  pull_request:
    branches: [main, develop]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

Azure DevOps Pipelines

# azure-pipelines.yml
trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - script: |
      pip install semgrep
      semgrep scan --config=auto --config=p/security-audit . --json --output=semgrep-results.json
    displayName: 'Run Semgrep SAST'

  - task: PublishCodeCoverageResults@2
    inputs:
      summaryFileLocation: '$(System.DefaultWorkingDirectory)/semgrep-results.json'
      pathToSources: '$(System.DefaultWorkingDirectory)'
    displayName: 'Publish Results'

Azure DevOps Shell Compatibility:

• No brace expansion: Use pip install semgrep bandit instead of pip install {semgrep,bandit}
• No bash arrays: Use explicit repeated flags instead of for config in configs; do ...
• Task parameters: PublishCodeCoverageResults@2 uses summaryFileLocation (NOT summaryFile)
• Use script: (not bash:) for cross-platform compatibility, or explicitly set bash: when bash features are needed

---

Integration Workflow

Recommended Order

1. Prerequisites Check - Verify tools
2. Auto-detect Scan - semgrep --config=auto
3. Language-Specific - Add framework rules
4. Pattern Fallback - If tools unavailable
5. Manual Review - CRITICAL/HIGH findings

Scan Script Example

#!/bin/bash
echo "=== Multi-Language SAST Report ==="

# Detect languages
echo "Detecting languages..."
find . -type f \( -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.go" -o -name "*.java" \) -not -path "./.venv/*" -not -path "./node_modules/*" -not -path "./.git/*" 2>/dev/null

# Universal scan with Semgrep
if command -v semgrep &> /dev/null; then
    echo "Running Semgrep..."
    semgrep scan --config=auto --config=p/security-audit . --json-output /tmp/semgrep-report.json 2>/dev/null
    echo "Results saved to /tmp/semgrep-report.json"
else
    echo "Semgrep not found, using pattern matching..."
fi

After scan: Read /tmp/semgrep-report.json with the Read tool to analyze results and count findings.

---

Troubleshooting

Problem	Solution
semgrep: command not found	pip install semgrep or brew install semgrep
Scan timeout	Use --exclude or scan specific dirs
Too many results	Filter by severity: jq 'select(.severity == "ERROR")'
Missing language rules	Check semgrep registry for available configs
False positives	Create .semgrepignore file

---

References

• Semgrep Registry
• Semgrep Framework-Native Analysis
• OWASP Top 10:2025