Bump semgrep from 1.48.0 to 1.51.0

[dependabot]

Bumps semgrep from 1.48.0 to 1.51.0.

Release notes

Sourced from semgrep's releases.

Release v1.51.0

1.51.0 - 2023-11-29

Added

• taint-mode: Added experimental rule option taint_match_on: source that makes Semgrep report taint findings on the taint source rather than on the sink. (pa-3272)

Changed

• Elixir got moved to Pro. (elixir_pro)
• The 'fix_regex' field has been removed from the semgrep JSON output. Instead, the 'fix' field contains the content the result of the fix_regex. (fix_regex)
• taint-mode: Tweaked experimental option taint_only_propagate_through_assignments so that when it is enabled, tainted.field and tainted(args) will no longer propagate taint. (pa-2193)

Fixed

• Fixed Kotlin parse error.

  Previously, code like this would throw a parse error

  fun f1(context : Context) {
      Foo(context).elem = var1
  }
  

  due to not recognizing Foo(context).elem = ... as valid. Now calls are recognized as valid in the left hand of assignments. (ea-104)

• Python: async statements are now translated into the Dataflow IL so Semgrep will be able to report findings e.g. inside async with ... statements. (gh-9182)

• In gitlab output, use correct url attached to rule instead of generating it. This fixes url for supply chain findings. (gitlab)

• • The language server will no longer crash on startup for intellij (language-server)
• • The language server no longer crashes when installed through pip on Mac platforms (language-server-macos)

• taint-mode: When we encountered an assignment lval := expr where expr returned no taints, we automatically cleaned lval. This was correct in the early days of taint-mode, before we introduced taint by side-effect, but it is wrong now. The LHS lval may be tainted by side-effect, in which case we cannot clean it just because expr returns no taint. Now that we introduced by-side-effect: only it is also possible for expr to taint lval by side-effect and return no immediate taint.

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.51.0 - 2023-11-29

Added

• taint-mode: Added experimental rule option taint_match_on: source that makes Semgrep report taint findings on the taint source rather than on the sink. (pa-3272)

Changed

• Elixir got moved to Pro. (elixir_pro)
• The 'fix_regex' field has been removed from the semgrep JSON output. Instead, the 'fix' field contains the content the result of the fix_regex. (fix_regex)
• taint-mode: Tweaked experimental option taint_only_propagate_through_assignments so that when it is enabled, tainted.field and tainted(args) will no longer propagate taint. (pa-2193)

Fixed

• Fixed Kotlin parse error.

  Previously, code like this would throw a parse error

  fun f1(context : Context) {
      Foo(context).elem = var1
  }
  

  due to not recognizing Foo(context).elem = ... as valid. Now calls are recognized as valid in the left hand of assignments. (ea-104)

• Python: async statements are now translated into the Dataflow IL so Semgrep will be able to report findings e.g. inside async with ... statements. (gh-9182)

• In gitlab output, use correct url attached to rule instead of generating it. This fixes url for supply chain findings. (gitlab)

• • The language server will no longer crash on startup for intellij (language-server)
• • The language server no longer crashes when installed through pip on Mac platforms (language-server-macos)

• taint-mode: When we encountered an assignment lval := expr where expr returned no taints, we automatically cleaned lval. This was correct in the early days of taint-mode, before we introduced taint by side-effect, but it is wrong now. The LHS lval may be tainted by side-effect, in which case we cannot clean it just because expr returns no taint. Now that we introduced by-side-effect: only it is also possible for expr to taint lval by side-effect and return no immediate taint.

  This kind of source should now work as expected:

  - by-side-effect: true
    patterns:

... (truncated)

Commits

• 0dde27b chore: Bump version to 1.51.0
• d050f8c fix: tainting: Remove Pro-hack for lval = new ... (#9334)
• c6395f3 feat(osemgrep): port install-semgrep-pro (#9279)
• 836ef89 fix(ls): Bug bonanza (#9288)
• b36921f fix(output): use correct url for gitlab output (#9338)
• aaa11b7 fix: tainting: Do not taint subexpressions of by-side-effect: only (#9329)
• bee5f90 Add xfail for homeassistant public repos (#9341)
• 95e688e make is now 'make core', make test is now make core-test (#9340)
• c579057 chore(ls): Make semgrep lsp.js easy to distribute (#9302)
• 66c7952 New semgrep rule to forbid use of Http_helpers outside networking/ (#9333)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like semgrep is up-to-date now, so this is no longer needed.