reference Flags

--inline-metavariables

Accepted by
opengrep scan, opengrep ci
See also
--json, metadata

The metavariables in the message of a finding are always replaced: a rule with the message found eval of $X reports found eval of user. The strings in the metadata of the rule are copied to the output unchanged. --inline-metavariables replaces the metavariables in them as well.

The replacement processes the whole metadata of every finding, which takes time when the metadata is large or deeply nested.

Examples

A metavariable inside metadata

rule.yaml
rules:  - id: eval-call    pattern: eval($X)    message: found eval of $X    metadata:      note: "the argument was $X"    languages: [python]    severity: WARNING
app.py
def handler(user):    eval(user)
Command and result
$ opengrep scan --config rule.yaml --json app.py 2>/dev/null | jq .
{
  "version": "X.Y.Z",
  "results": [
    {
      "check_id": "eval-call",
      "path": "app.py",
      "start": {
        "line": 2,
        "col": 5,
        "offset": 23
      },
      "end": {
        "line": 2,
        "col": 15,
        "offset": 33
      },
      "extra": {
        "metavars": {
          "$X": {
            "start": {
              "line": 2,
              "col": 10,
              "offset": 28
            },
            "end": {
              "line": 2,
              "col": 14,
              "offset": 32
            },
            "abstract_content": "user"
          }
        },
        "message": "found eval of user",
        "metadata": {
          "note": "the argument was $X"
        },
        "severity": "WARNING",
        "fingerprint": "5100909fef918cfe3c3b611def4015a653bb8e4446f51f5032cbaecd6b98b01f96d5cfed25a9c0d2ed7b6759ec5057fc25dfc0c99a337e60a96237f7b03baaa9_0",
        "lines": "    eval(user)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    }
  ],
  "errors": [],
  "paths": {
    "scanned": [
      "app.py"
    ]
  },
  "interfile_languages_used": [],
  "skipped_rules": []
}
$ opengrep scan --config rule.yaml --json --inline-metavariables app.py 2>/dev/null | jq .
{
  "version": "X.Y.Z",
  "results": [
    {
      "check_id": "eval-call",
      "path": "app.py",
      "start": {
        "line": 2,
        "col": 5,
        "offset": 23
      },
      "end": {
        "line": 2,
        "col": 15,
        "offset": 33
      },
      "extra": {
        "metavars": {
          "$X": {
            "start": {
              "line": 2,
              "col": 10,
              "offset": 28
            },
            "end": {
              "line": 2,
              "col": 14,
              "offset": 32
            },
            "abstract_content": "user"
          }
        },
        "message": "found eval of user",
        "metadata": {
          "note": "the argument was user"
        },
        "severity": "WARNING",
        "fingerprint": "5100909fef918cfe3c3b611def4015a653bb8e4446f51f5032cbaecd6b98b01f96d5cfed25a9c0d2ed7b6759ec5057fc25dfc0c99a337e60a96237f7b03baaa9_0",
        "lines": "    eval(user)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    }
  ],
  "errors": [],
  "paths": {
    "scanned": [
      "app.py"
    ]
  },
  "interfile_languages_used": [],
  "skipped_rules": []
}