semgrep-rules VS blog-spring-actuator-example

Nice and all, but why not contribute to https://github.com/returntocorp/semgrep-rules ?

Well, the rules they actually added are pretty noisy. There's also not a lot of them.

The semgrep registry contains lots of rules for many issues, and you can contribute your own.

Hadolint is great! If you want to customize your lint logic beyond the checks in it, I recently wrote a Semgrep rule to require all our Dockerfiles to pin images with a sha256 hash that could be a good starting point: https://github.com/returntocorp/semgrep-rules/pull/1861/file...

Semgrep Rules for searching source code

Interested? More details are in this Hacktoberfest README.

Semgrep rules are fairly easy to wrap your head around, so let's build one for our example application from the previous part of this series. To be able to showcase some of the capabilities of semgrep, we'll be using the YAML configuration syntax for Spring. This is what a basic vulnerable Spring configuration could look like:

I've created a basic, vulnerable Spring application that exposes all endpoints if you want to follow along at home. Running it locally on your machine and accessing the Spring actuators endpoint, you will get the following output: