reference > Flags

--enable-interfile

Accepted by

opengrep scan, opengrep ci, opengrep test

See also

taint_interfile, --interfile-depth, --interfile-timeout, --interfile-dedup-by, --taint-intrafile, --disable-intrafile, mode: taint

Enables cross-file taint analysis. The analysis applies only to the taint rules whose options set taint_interfile: true (or its alias interfile: true). A rule runs across files only when both the flag and the option are present:

Without the flag, a rule that sets the option is analyzed file by file and function by function. Calls to functions in the same file are followed only when --taint-intrafile or the option taint_intrafile asks for it.

With the flag, Opengrep builds a call graph of the project. A file that holds sources but no sinks, or sinks but no sources, is analyzed together with the files it is connected to in the graph, following call chains up to --interfile-depth calls long. Calls within a file are followed as well, as with --taint-intrafile. A finding is reported in the file that holds the sink, with a from: line naming the file and line of the source.

The cross-file analysis parses every file of the project to build the graph, so it costs more than a file-by-file scan. --interfile-timeout limits the time a rule may spend on it, and --disable-intrafile turns it off along with the analysis within files.

## Examples

### Taint that crosses a file boundary

rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR    options:      taint_interfile: true

import osdef run(cmd):    os.system(cmd)

from util import runrun(input())

$ opengrep scan -q --config rule.yaml .
$ opengrep scan -q --config rule.yaml --enable-interfile .
util.py

  error  input-to-system
  user input reaches os.system

     4: os.system(cmd)

  from: main.py
     3: input()

Without the flag, the rule is analyzed one file at a time, and the first scan reports nothing.

### In a rule test

opengrep test accepts the flag as well. The rule file is tested against the files of the directory with the same name.

rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR    options:      taint_interfile: true

import osdef run(cmd):    # ruleid: input-to-system    os.system(cmd)

from util import runrun(input())

$ opengrep test --enable-interfile .
1/1: ✓ All tests passed
No tests for fixes found.