0.106.0 - 2022-07-21
Changed
-
metavariable-comparison
: Themetavariable
field is now optional, except
ifstrip: true
. Whenstrip: false
(the default) themetavaraible
field
has no use so it was pointless to require it. (metavariable-comparison-metavariable) -
metavariable-comparison
now also works on metavariables that cannot be evaluated
to simple literals. In such cases, we take the string representation of the code
bound by the metavariable. The way to access this string representation is via
str($MVAR)
. For example:- metavariable-comparison: metavariable: $X comparison: str($X) == str($Y)
Here
$X
and$Y
may bind to two different code variables, and we check whether
these two code variables have the same name (e.g. two different variables but both
namedx
). (pa-1659) -
When running an SCA scan with
semgrep ci --sca
,
SCA findings will no longer be considered blocking if they are unreachable. (sca-128)