Semgrep: [Ruby alpha] Cannot match function call when I specify some parameters

[dee-see]

Describe the bug
Trying to match the require :status part in a Graph API definition

      desc 'Create a status.'
      params do
        requires :status, type: String, desc: 'Your status.'
      end
      post do
        authenticate!
        Status.create!({
          user: current_user,
          text: params[:status]
        })
      end

matching require finds it but require :status and other variations (see semgrep.live link) doesn't.

To Reproduce
https://semgrep.live/w8jX/?version=develop

Expected behavior
The requires :status, type: String, desc: 'Your status.' line should match

Still not 100% if it's a bug or an error on my part.

[dee-see]

Issue #1337, I should have reported a security bug :)

[aryx]

Note that currently those keyword/hash arguments are not parsed as real keyword arguments in the generic AST
(they are parsed as Tuple of Atom => value)
and so the order currently matters. I can fix that in another PRs if needed so one can look for
foo kwd1:1, kwd2:2 and it would match also foo kwd2:2, kwd1:1

[aryx]

Note also that because of the rewriting, search for :x => v, will also match code written as x: v
which is nice I think.

[dee-see]

Is my repro from the issue (https://semgrep.live/w8jX/?version=develop) supposed to work now or it hasn't been deployed yet? I'm not sure how recent the develop version is supposed to be.

[dee-see]

And if it was indeed supposed to work, let me know if I should open a new issue @aryx

[ievans]

@dee-see develop == our main development branch on this issue. so it should work, re-opening this

[aryx]

It works, it's just a YAML syntax problem.
You need pattern: | see https://semgrep.live/Jd2Z/?version=develop
Not sure why YAML does not accept your syntax though. probably the requires: with a colon.

[aryx]

I've created a separate issue to try to accept your syntax (or at least give a better error message suggesting to use pattern: |

[nbrahms]

FWIW, I've found typing some horrendous YAML-breaking code in the simple editor, then switching to the advanced editor, to be a good way to properly format the YAML:

https://semgrep.dev/bo7v/?version=develop

Also, we're releasing a pattern-composition UI into the simple editor that will also help ease some of these pain points.