Semgrep: R Support

[zythosec]

Is your feature request related to a problem? Please describe.
Add support for the R programming language

Additional context
R provides a wide variety of statistical (linear and nonlinear modelling, classical statistical tests, time-series analysis, classification, clustering, …) and graphical techniques, and is highly extensible. It used frequently for data science and packages such as R-Shiny are used to build complete web applications, so it would be useful to identify any vulnerabilities that could arise.

[zythosec]

FYI I've started this work in my forks of semgrep-grammars and ocaml-tree-sitter.

[underyx]

Wow, that's wonderful news! We're happy to help you along the way if there's anything you need.

I was curious so I looked and found that lintr exists thus far for static analysis for R. I also found a formatting tool but not much else. I wonder how prevalent static analysis is in the R ecosystem currently 🤔

[zythosec]

Thanks! tree-sitter-r exists so R was pretty straight forward to add. The only other static analysis tool I could find was within R itself, CodeDepends, so I'm not sure how prevalent it is either.

[ievans]

This is super exciting @zythosec! I also wanted to mention that a good number of the people adding new languages are on Slack (https://r2c.dev/slack) if you ever have any urgent questions or want to talk about design decisions for new language additions.

[aryx]

@zythosec I think we're done with refactoring semgrep, pfff, and ocaml-tree-sitter to make it easier for external contributors to add languages. Let us know if you need some help with the new code organization and flow.