reference > Flags

--guarded-taint-signatures

Accepted by

opengrep scan

See also

--taint-intrafile, taint_intrafile, mode: taint, guarded_taint_signatures

The summary of a function that --taint-intrafile computes records that tainted arguments reach a sink, but not under which condition. A sink inside if mode == 1: is reported even for a call that passes 2.

With this flag, the summaries also record the conditions of the branches that lead to a sink, and each call checks them: an effect whose condition cannot hold for the arguments of the call is dropped. This removes false positives, at the cost of more analysis per function.

The flag is experimental. The rule option guarded_taint_signatures enables the same analysis for one rule. In Clojure, the conditions that select a function by its number of arguments are recorded with or without the flag.

## Examples

### A sink behind a condition the caller does not meet

rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: input reaches os.system    languages: [python]    severity: ERROR

import osdef run(cmd, mode):    if mode == 1:        os.system(cmd)run(input(), 2)

$ opengrep scan -q --config rule.yaml --taint-intrafile --files-with-matches guard.py
guard.py
$ opengrep scan -q --config rule.yaml --taint-intrafile --guarded-taint-signatures --files-with-matches guard.py

The call passes 2, so the sink under mode == 1 is unreachable. The second command drops the finding that the first one reports, and prints nothing.