reference > Flags

--allow-rule-timeout-control

Accepted by

opengrep scan, opengrep ci

Default

false

See also

--timeout, --dynamic-timeout, --dynamic-timeout-unit-kb, --dynamic-timeout-max-multiplier, dynamic_timeout

Applies the time limits that rules set in their options: timeout, dynamic_timeout, dynamic_timeout_unit_kb and dynamic_timeout_max_multiplier. Without the flag, Opengrep ignores these four options, and the limits set on the command line apply to every rule.

With the flag, each option replaces the value of the scan for that rule only: timeout replaces --timeout, and the other options replace the corresponding --dynamic-timeout flags. A scan run with --timeout 0 has no time limit, and the options of the rules do not apply.

## Examples

### A rule asking for a shorter limit

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING    options:      timeout: 0.001

$ seq 20000 | sed 's/.*/x& = f(&)/' > big.py && echo 'eval(1)' >> big.py
$ opengrep scan -q --config rule.yaml --files-with-matches big.py
big.py
$ opengrep scan -q --config rule.yaml --allow-rule-timeout-control --files-with-matches big.py
$ opengrep scan --config rule.yaml --allow-rule-timeout-control big.py 2>&1 >/dev/null | grep 'timeout error'
warning  1 timeout error(s) in big.py when running the following rules: [find-eval]

Without the flag, the rule has the limit of the scan, 5 seconds, and its finding is reported. With the flag, its own limit of a millisecond applies: the rule runs out of time and reports nothing.