semgrep: Use pattern-where-python operator to filter patterns.

See https://github.com/returntocorp/semgrep/blob/experimental/docs/config/advanced.md#pattern-where-python for usage.

This helps us minimize duplication of similar patterns.

tools/lint

@@ -89,7 +89,16 @@ def run() -> None:
                                   description="Checks commit messages for common formatting errors."
                                   "(config: .gitlint)")
 
-    semgrep_command = ["semgrep", "--config=./tools/semgrep.yml", "--error"]
+    semgrep_command = ["semgrep", "--config=./tools/semgrep.yml", "--error",
+                       # This option is dangerous in the context of running
+                       # semgrep-as-a-service on untrusted user code, since it
+                       # causes Python code in the rules configuration to be
+                       # executed.  From our standpoint, it is required for
+                       # `pattern-where-python` rules, and there's no real
+                       # security impact, since if you can put arbitrary code
+                       # into zulip.git, you can run arbitrary code in a Zulip
+                       # development environment anyway.
+                       "--dangerously-allow-arbitrary-code-execution-from-rules"]
     linter_config.external_linter('semgrep-py', [*semgrep_command, "--lang=python"], ['py'],
                                   fix_arg='--autofix',
                                   description="Syntactic Grep (semgrep) Code Search Tool "

tools/semgrep.yml

@@ -52,27 +52,13 @@ rules:
 
   - id: logging-format
     languages: [python]
-    pattern-either:
+    patterns:
-      - pattern: logging.debug(... % ...)
+      - pattern-either:
-      - pattern: logging.debug(... .format(...))
+          - pattern: logging.$Y(... % ...)
-      - pattern: logger.debug(... % ...)
+          - pattern: logging.$Y(... .format(...))
-      - pattern: logger.debug(... .format(...))
+          - pattern: logger.$Y(... % ...)
-      - pattern: logging.info(... % ...)
+          - pattern: logger.$Y(... .format(...))
-      - pattern: logging.info(... .format(...))
+      - pattern-where-python: "vars['$Y'] in ['debug', 'info', 'warning', 'error', 'critical']"
-      - pattern: logger.info(... % ...)
-      - pattern: logger.info(... .format(...))
-      - pattern: logging.warning(... % ...)
-      - pattern: logging.warning(... .format(...))
-      - pattern: logger.warning(... % ...)
-      - pattern: logger.warning(... .format(...))
-      - pattern: logging.error(... % ...)
-      - pattern: logging.error(... .format(...))
-      - pattern: logger.error(... % ...)
-      - pattern: logger.error(... .format(...))
-      - pattern: logging.critical(... % ...)
-      - pattern: logging.critical(... .format(...))
-      - pattern: logger.critical(... % ...)
-      - pattern: logger.critical(... .format(...))
     severity: ERROR
     message: "Pass format arguments to logging (https://docs.python.org/3/howto/logging.html#optimization)"