Semgrep Rules (0xdea)

What it is

The 0xdea Semgrep ruleset for C/C++ vulnerability research, with concrete run modes and a false-positive tradeoff the summary only gestures at. Tested with Semgrep CLI 1.169.0.

How it works

Rules are split into a "battle-tested" core (~50 rules spanning insecure API use, buffer/copy sizing, integer wraparound/truncation, use-after-free/double-free, format strings, privilege ordering, ReDoS, etc.) and a separate set flagged as too noisy for general use — currently bad-words (keywords/comments hinting at bugs). Severity flags let you dial precision: ERROR-only is the quick-win tier, ERROR+WARNING is the recommended tier, and unfiltered runs surface marginal findings with more false positives.

What to do

Run against a target repo via the registry, choosing a tier:

# high priority scan (quick wins)
semgrep --severity ERROR --config "p/0xdea"

# high and medium priority scan (recommended)
semgrep --severity ERROR --severity WARNING --config "p/0xdea"

# full scan (might include marginal findings and more false positives)
semgrep --config "p/0xdea"

Or clone and run rules locally, including a single rule:

semgrep --config semgrep-rules/rules /path/to/source
semgrep --config semgrep-rules/rules/c/command-injection.yaml /path/to/source

To scan files ignored by git (common when auditing vendored or decompiled code), add --no-git-ignore. For triage, emit SARIF and open it with SARIF Explorer in VS Code:

semgrep --sarif --sarif-output=/path/to/source/SEMGREP.sarif --config semgrep-rules/rules /path/to/source
code /path/to/source

Caveats

The author frames these as research aids, not a clean CI gate: the full scan is explicitly expected to include marginal findings and false positives, and the noisy tier (bad-words) is excluded from p/0xdea by design. The roadmap notes ongoing work on accuracy, per-rule performance (some rules may be slow against real-world code), and scripts to clean up decompiler pseudocode so Semgrep can parse it — so parsing of decompiled input is a known rough edge today. Pinned to Semgrep CLI 1.169.0; behavior on other versions is untested.