reference > Flags

--interfile-depth

Accepted by

opengrep scan, opengrep ci, opengrep test

Value

INT

Default

3

See also

--enable-interfile, taint_interfile_depth, --interfile-timeout, taint_interfile

Sets how many calls deep the cross-file taint analysis of --enable-interfile follows the call graph when it gathers the files to analyze together. With the default of 3, a source reaches a sink three calls away, but not four. A negative value removes the limit.

Each additional level can bring more files into the analysis, so the cost of a scan grows with the depth.

A rule can set its own depth with the option taint_interfile_depth, which takes precedence over this flag. Without --enable-interfile, the flag has no effect.

## Examples

### A chain of three calls

rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: input reaches os.system    languages: [python]    severity: ERROR    options:      taint_interfile: true

import osdef sink_it(cmd):    os.system(cmd)

from d import sink_itdef step_c(x):    sink_it(x)

from c import step_cdef step_b(x):    step_c(x)

from b import step_bstep_b(input())

$ opengrep scan -q --config rule.yaml --enable-interfile --interfile-depth 2 --files-with-matches .
$ opengrep scan -q --config rule.yaml --enable-interfile --interfile-depth 3 --files-with-matches .
d.py

The source in a.py is three calls away from the sink in d.py. At depth 2, the first scan does not reach it and reports nothing.