35 more Semgrep rules: infrastructure, supply chain, and Ruby

This blog post will briefly cover the new rules, then explore two Semgrep features in depth: regex mode (especially how it compares against generic mode), and HCL language support for technologies such as Terraform and Nomad. rules : - id : vault-skip-tls-verify message : | Found Terraform Vault instance with TLS verification disabled languages : [ hcl] severity : WARNING patterns : - pattern-inside : provider "vault" { ... } - pattern : skip_tls_verify = true Figure 1: Semgrep rule searching for disabled TLS verification ( hcl/terraform/vault-skip-tls-verify.yaml rules : - id : vault-hardcoded-token message : | Found Terraform Vault instance with hardcoded token languages : [ hcl] severity : WARNING patterns : - pattern-inside : provider "vault" { ...