Skip to content

Commit 608bc27

Browse files
pabloests-santillan
pabloest
and
s-santillan
authored
Break out comparison FAQ content into subpages (#1993)
* Break out comparison FAQ content into subpages * Update links * Update metadata * follow bare verbs convention --------- Co-authored-by: s-santillan <[email protected]>
1 parent 532b7ea commit 608bc27

11 files changed

+279
-185
lines changed

‎docs/faq/comparisons/codeql.md

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
slug: codeql
3+
append_help_link: true
4+
hide_table_of_contents: true
5+
displayed_sidebar: aboutSidebar
6+
tags:
7+
- Support
8+
description: >-
9+
See how Semgrep compares to CodeQL.
10+
---
11+
12+
import TOCInline from "@theme/TOCInline"
13+
14+
# Compare Semrep to CodeQL
15+
16+
<TOCInline toc={toc} />
17+
18+
Both Semgrep and CodeQL use static analysis to find bugs, but there are a few differences:
19+
20+
<!-- vale off -->
21+
- Semgrep operates directly on source code, whereas CodeQL requires a buildable environment.
22+
- Semgrep provides both proprietary and open source options that can be run anywhere; CodeQL is not open source and you must pay to run it on any non-open-source code.
23+
- Semgrep focuses on speed and ease of use. and doesn’t require compiled code.
24+
- Semgrep Community Edition (CE) provides [intraprocedural dataflow](/writing-rules/data-flow/data-flow-overview). [Semgrep Code](/semgrep-code/overview)'s cross-file and cross-function analysis has similar capabilities as CodeQL in terms of cross-function dataflow analysis for a subset of supported languages.
25+
- Both have publicly available rules.
26+
- Semgrep rules look like the source code you’re writing; CodeQL has a separate domain-specific-language for writing queries.
27+
- Semgrep has an online, hosted free plan for up to ten contributors to private repositories; both have a hosted paid plan.
28+
<!-- vale on -->
29+
30+
See [Semgrep versus GitHub Advanced Security](https://semgrep.dev/resources/semgrep-github/) for more about what makes Semgrep different.

‎docs/faq/comparisons/endor-labs.md

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
---
2+
slug: endor-labs
3+
append_help_link: true
4+
hide_table_of_contents: true
5+
displayed_sidebar: aboutSidebar
6+
tags:
7+
- Support
8+
description: >-
9+
See how Semgrep compares to Endor Labs.
10+
---
11+
12+
import TOCInline from "@theme/TOCInline"
13+
14+
# Compare Semgrep to Endor Labs
15+
16+
<TOCInline toc={toc} />
17+
18+
## Prioritization
19+
20+
Both Endor Labs and Semgrep support the prioritization of findings so that AppSec teams focus on the most impactful findings. While both companies offer findings filters based on criteria like reachability and EPSS scores, Semgrep offers support for statuses in addition to the basic reachability statuses of **reachable** and **not reachable**, such as **always reachable** and **conditionally reachable**.
21+
22+
Furthermore, Semgrep Assistant uses AI to help organization admins receive information on top backlog tasks, allowing them to prioritize findings from all products, including the SAST and SCA products, not just those resulting from dependency vulnerability scans.
23+
24+
## Reachability for transitive dependencies
25+
26+
Reachability has been a fundamental part of Semgrep Supply Chain from the beginning. Supply Chain offers advanced reachability analysis for direct dependencies in the form of dataflow reachability, offering accuracy beyond that offered by Endor Labs. This coverage is offered for seven languages and counting.
27+
28+
## Vulnerable functions
29+
30+
Semgrep doesn't just identify a vulnerability as reachable when a vulnerable function is called -- it also takes into account *how* the vulnerable function is called and what data flows into that function. These functions are achieved through the use of Semgrep's rule syntax; when a rule is written, all possible permutations of the vulnerability are encapsulated in the rule. This functionality is something that Endor Labs doesn't have.
31+
32+
Semgrep's security research team doesn't just focus on analyzing a vulnerable function when writing rules. The team extends the scope of analysis to all the third-party callers of the vulnerable functions, not just the reported third-party function that's vulnerable. This extends the set of vulnerable functions greatly. The following rule demonstrates this functionality:
33+
34+
```yaml
35+
---
36+
rules:
37+
- id: ssc-a462c702-1797-4f92-a577-2232cc25ab08
38+
message: Affected versions of paddlepaddle are vulnerable to Improper Limitation
39+
Of A Pathname To A Restricted Directory ('Path Traversal') in the
40+
`download` and `_check_exists_and_download` of `paddle.dataset.common`.
41+
severity: ERROR
42+
metadata:
43+
confidence: HIGH
44+
category: security
45+
cve: CVE-2024-0818
46+
cwe:
47+
- "CWE-22: Improper Limitation of a Pathname to a Restricted Directory
48+
('Path Traversal')"
49+
ghsa: GHSA-2rp8-hff9-c5wr
50+
owasp:
51+
- A01:2021 - Broken Access Control
52+
- A05:2017 - Broken Access Control
53+
- A06:2021 - Vulnerable and Outdated Components
54+
publish-date: 2024-03-07T15:30:38Z
55+
references:
56+
- https://github.com/advisories/GHSA-2rp8-hff9-c5wr
57+
- https://nvd.nist.gov/vuln/detail/CVE-2024-0818
58+
sca-fix-versions: []
59+
sca-kind: reachable
60+
sca-schema: 20230302
61+
sca-severity: CRITICAL
62+
sca-vuln-database-identifier: CVE-2024-0818
63+
technology:
64+
- python
65+
r2c-internal-project-depends-on:
66+
depends-on-either:
67+
- namespace: pypi
68+
package: paddlepaddle
69+
version: <=2.6.0
70+
languages:
71+
- python
72+
patterns:
73+
- pattern-either:
74+
- pattern: paddle.dataset.common.download(...)
75+
- pattern: paddle.dataset.common._check_exists_and_download(...)
76+
```
77+
78+
The vulnerable function is `download`, as shown by the [fix commit](https://github.com/PaddlePaddle/Paddle/commit/5c50d1a8b97b310cbc36560ec36d8377d6f29d7c). The function `_check_exists_and_download` calls `download`, which you can see in the [source code](https://github.com/PaddlePaddle/Paddle/blob/5c50d1a8b97b310cbc36560ec36d8377d6f29d7c/python/paddle/dataset/common.py#L223). Thus, both functions are flagged in the rule in the final three lines.
79+
80+
Learn more about how the security research team writes rules in [A day in the life: Supply Chain Security Researcher](https://semgrep.dev/blog/2024/a-day-in-the-life-supply-chain-security-researcher)
81+
82+
## Policies and flexibility
83+
84+
Semgrep Supply Chain results in a failed CI job only when there are critical or high-severity findings. However, Semgrep supports notifications and integration with Jira to create tickets for all Supply Chain findings, and it offers the ability to only leave comments on PRs or block a change regarding license detection.
85+
86+
The policies for Semgrep's other products, Semgrep Code and Semgrep Secrets, provide extensive flexibility, especially with respect to a developer's workflow, by allowing results to appear:
87+
88+
- Only in the AppSec team’s view (monitor mode)
89+
- In the AppSec team's view **and** in the developer’s workflow, while not failing the CI job (comment mode)
90+
- In the AppSec team's view **and** in the developer’s workflow, while also failing the CI job (block mode)
91+
92+
## Dependency lifecycle management
93+
94+
To help you manage your findings, Semgrep provides information, including EPSS probabilities, severity levels, transitivity information, and multiple levels of dataflow reachability.
95+
96+
## Accuracy of results
97+
98+
Semgrep has reachability analysis for over 80% of critical CVEs dating back to 2017 and 100% of critical and high severity CVEs dating back to May 2022. Endor Labs' reachability data, however, dates back to 2018.

‎docs/faq/comparisons/opengrep.md

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
slug: opengrep
3+
append_help_link: true
4+
hide_table_of_contents: true
5+
displayed_sidebar: aboutSidebar
6+
tags:
7+
- Support
8+
description: >-
9+
See how Semgrep compares to Opengrep.
10+
---
11+
12+
import TOCInline from "@theme/TOCInline"
13+
14+
# Compare Semgrep to Opengrep
15+
16+
<TOCInline toc={toc} />
17+
18+
## What is Opengrep?
19+
20+
Opengrep is a fork of the Semgrep Community Edition (CE) engine, formerly known as Semgrep OSS (Semgrep Open Source).
21+
22+
## How is Opengrep licensed?
23+
24+
The Opengrep engine is licensed under LGPL 2.1. This means that any copies of the Opengrep engine must include a copy of the full license text and the original copyright notice, must make available the source code when a derivative work is distributed, and such derivative works must be licensed under the same or later version of the LGPL.
25+
26+
## What is Semgrep Community Edition (CE)?
27+
28+
Semgrep Community Edition is the collective name for the open source Semgrep engine (formerly known as the Semgrep OSS engine) and the collection of rules published and maintained by the Semgrep community and Semgrep, Inc.
29+
30+
## How is Semgrep CE licensed?
31+
32+
33+
The Semgrep CE engine is licensed under LGPL 2.1. This license has remained unchanged since Semgrep, Inc. began development on the Semgrep engine in early 2020.
34+
35+
Semgrep maintains a collection of rules written by the community and Semgrep, Inc., and they are licensed under the [Semgrep Rules License](https://semgrep.dev/legal/rules-license/). This license limits their use to internal, non-competing, and non-SaaS contexts, and explicitly limits certain commercial usage. This applies to all rules authored by Semgrep and those contributed to our public repositories.
36+
37+
## What changed with Semgrep’s licensing in December, 2024?
38+
39+
The license for Semgrep's Community Edition engine remains unchanged: LGPL 2.1.
40+
41+
Licensing for Semgrep-maintained rules changed from Commons Clause w/ LGPL 2.1 to the [Semgrep Rules License](https://semgrep.dev/legal/rules-license/).

‎docs/faq/comparisons/snyk.md

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
slug: snyk
3+
append_help_link: true
4+
hide_table_of_contents: true
5+
displayed_sidebar: aboutSidebar
6+
tags:
7+
- Support
8+
description: >-
9+
See how Semgrep compares to Snyk.
10+
---
11+
12+
import TOCInline from "@theme/TOCInline"
13+
14+
15+
# Compare Semgrep to Snyk
16+
17+
<TOCInline toc={toc} />
18+
19+
## SAST
20+
21+
Both Semgrep and Snyk offer out-of-the-box SAST solutions. Semgrep makes it easier to customize the rules that run against your code. Because these rules are visible and customizable, you can analyze your results to see if the relevant vulnerabilities were caught.
22+
23+
In addition to selecting your rules, Semgrep allows you to write custom rules to capture use cases driven by your organization's goals. To help you write rules, [Semgrep Editor](https://semgrep.dev/playground) provides a structure mode to guide you through the process, allows you to test your in-progress rules, and adds them to your organization’s [Policies page](/semgrep-code/policies). Semgrep offers rule-writing capabilities to all users, while Snyk limits it to Enterprise users.
24+
25+
Both Semgrep and Snyk offer remediation advice for findings identified during scans. Snyk displays its recommendations in its web app, in supported IDEs, and CLI, while Semgrep displays remediation advice and guidance in its web app, CLI, supported IDEs, and in the form of PR or MR comments.
26+
27+
Snyk and Semgrep both display prioritization metrics to help you decide which findings you should work on first. For SAST, Snyk encapsulates this information into a priority score, which provides you with information on the impact and actionability related to the finding. Semgrep, on the other hand, provides severity information, confidence in the rule to detect findings that are true positives, and likelihood that an attacker can exploit the issues found.
28+
29+
Additionally, Semgrep provides action recommendations through Assistant, which offers AI-powered security recommendations to help you review, triage, and remediate your Semgrep findings.
30+
31+
Snyk offers autofix capability for its SCA product, but not its SAST product. Semgrep offers autofix suggestions for SAST and SCA, where its [rules contain suggested fixes to resolve findings](/writing-rules/autofix). In the event of a true positive where the rule doesn't have a human-written autofix, [Assistant can generate an autofix](/semgrep-assistant/overview#autofix).
32+
33+
## SCA
34+
35+
Snyk offers reachability analysis for Java, JavaScript, and TypeScript, while Semgrep offers reachability analysis for [multiple languages, including Java, JavaScript, and Ruby](/supported-languages/#semgrep-supply-chain)
36+
37+
Snyk can detect whether dependencies are direct or transitive. However, this information is only available with Enterprise plans, and the information is limited to projects using Maven or Node.js, specifically npm and Yarn packages. Semgrep Supply Chain offers advanced reachability analysis for direct dependencies in the form of dataflow reachability. Semgrep offers this coverage for seven languages and counting.
38+
39+
Semgrep and Snyk both offer license compliance features, ensuring that the dependencies that your developers use meet the requirements set by your organization.
40+
41+
To help you manage your findings, Semgrep provides you with the findings' EPSS probabilities, severity levels and transitivity information. Snyk assesses impact and likelihood and encapsulates this information into a risk score.
42+
43+
## Policies and rules management
44+
45+
Semgrep Code and Semgrep Secret's policies management feature provides extensive flexibility, especially with respect to a developer's workflow, by allowing results to appear:
46+
47+
- Only in the AppSec team’s view (monitor mode)
48+
- In the AppSec team's view **and** in the developer’s workflow, while not failing the CI job (comment mode)
49+
- In the AppSec team's view **and** in the developer’s workflow, while also failing the CI job (block mode)
50+
51+
Semgrep Supply Chain results in a failed CI job only when there are critical or high-severity findings.
52+
53+
## Secrets detection
54+
55+
Semgrep Secrets leverages semantic analysis, entropy analysis, and validation to accurately detect and fix secrets. Snyk maintains a [business partnership with GitGuardian](https://blog.gitguardian.com/were-teaming-up-with-snyk-to-strengthen-developer-security/) to offer secrets scanning as part of Snyk Code.

‎docs/faq/comparisons/sonarqube.md

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
slug: sonarqube
3+
append_help_link: true
4+
hide_table_of_contents: true
5+
displayed_sidebar: aboutSidebar
6+
tags:
7+
- Support
8+
description: >-
9+
See how Semgrep compares to SonarQube.
10+
---
11+
12+
import TOCInline from "@theme/TOCInline"
13+
14+
# Compare Semgrep to SonarQube
15+
16+
<TOCInline toc={toc} />
17+
18+
Both Semgrep and SonarQube use static analysis to find bugs, but there are a few differences:
19+
20+
- Extending Semgrep with custom rules is simple since Semgrep rules look like the source code you’re writing. Writing custom rules with SonarQube is [<i class="fas fa-external-link fa-xs"></i> restricted to a handful of languages](https://docs.sonarqube.org/latest/extend/adding-coding-rules/) and requires familiarity with Java and abstract syntax trees (ASTs).
21+
- Semgrep supports user-defined autofixes; SonarQube does not.
22+
- Semgrep focuses on speed and ease-of-use, making analysis possible at up to 20K-100K loc/sec per rule. SonarQube authors [report approximately 0.4K loc/sec for rulesets in production](https://web.archive.org/web/20221109203440/https://community.sonarsource.com/t/performance-guide-for-large-project-analysis/148/2).
23+
- Semgrep supports scanning only changed files (differential analysis), SonarQube does not.
24+
- Both have publicly available rules
25+
- Semgrep has an online, hosted free plan for up to ten contributors to private repositories; both have a hosted paid plan.
26+
27+
See [the Semgrep development philosophy](/contributing/semgrep-philosophy) for more about what makes Semgrep different.

0 commit comments

Comments
 (0)