reference Flags

--interfile-dedup-by

Accepted by
opengrep scan, opengrep ci
Value
sink or source-sink
Default
sink
See also
--enable-interfile, taint_interfile

A taint finding is reported at its sink. When the cross-file analysis of --enable-interfile finds several sources that reach the same sink, this flag sets how many findings they produce:

ValueFindings
sinkOne for the sink, showing one of the sources.
source-sinkOne for each source that reaches the sink.

With source-sink, the JSON and SARIF outputs contain one result per source. The text output shows the sink once, with a from: line for each source.

The flag applies only to rules analyzed across files. Other rules report each sink once.

Examples

Two callers in other files

rule.yaml
rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: input reaches os.system    languages: [python]    severity: ERROR    options:      taint_interfile: true
util.py
import osdef run(cmd):    os.system(cmd)
main.py
from util import runrun(input())
other.py
from util import runrun(input())
Command and result
$ opengrep scan -q --config rule.yaml --enable-interfile .
util.py

  error  input-to-system
  input reaches os.system

     4: os.system(cmd)

  from: main.py
     3: input()
$ opengrep scan -q --config rule.yaml --enable-interfile --interfile-dedup-by source-sink .
util.py

  error  input-to-system
  input reaches os.system

     4: os.system(cmd)

  from: main.py
     3: input()
  from: other.py
     3: input()