reference > Flags

--disable-intrafile

Accepted by

opengrep scan, opengrep ci, opengrep test

See also

--taint-intrafile, taint_intrafile, --enable-interfile

Turns off the analysis that follows taint through calls to functions defined in the same file, for every taint rule of the scan. It takes precedence over --taint-intrafile and over the rule option taint_intrafile.

The cross-file analysis is built on the same per-function summaries, so it is turned off as well: --enable-interfile and the rule option taint_interfile have no effect.

Each taint rule then analyzes one function at a time. Taint that flows from a source to a sink within a single function is still reported.

## Examples

### A rule that asks to follow calls

rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: input reaches os.system    languages: [python]    severity: ERROR    options:      taint_intrafile: true

import osdef run(cmd):    os.system(cmd)run(input())os.system(input())

$ opengrep scan -q --config rule.yaml app.py
app.py

  error  input-to-system
  input reaches os.system

     4: os.system(cmd)

     7: os.system(input())
$ opengrep scan -q --config rule.yaml --disable-intrafile app.py
app.py

  error  input-to-system
  input reaches os.system

     7: os.system(input())

With the flag, the call to run is not followed. Only the sink on line 7, which the source reaches within the same function, is reported.