I'm trying out Semgrep for a new vendor security review. My team wants to flag any use of `eval()` in our JavaScript code.
I wrote this simple rule, but the CLI says "invalid pattern" when I run `semgrep --config my_rule.yaml`. The pattern looks correct to me based on the docs. What am I missing?
Here's my rule.yaml:
```
rules:
- id: no-eval-js
patterns:
- pattern: eval(...)
message: Avoid eval() for security reasons.
languages: [javascript]
severity: ERROR
```
The pattern syntax looks right, but Semgrep's JS parser needs the call expression. Try `pattern: eval(...)` inside a `pattern-either` block with a `metavariable` constraint, or just use the simple form: `pattern: $FUNC(...)` and then a separate `metavariable-regex` for the function name.
I'd rewrite it like this:
```
rules:
id: no-eval-js
patterns:
pattern: $FUNC(...)
metavariable-regex:
metavariable: $FUNC
regex: eval
message: Avoid eval() for security reasons.
languages: [javascript]
severity: ERROR
```
That usually works better for matching function names. The ellipsis operator in the pattern can be picky about standalone calls.
null