`--max-match-per-file`

Accepted by: opengrep scan, opengrep ci
Value: INT
Default: 10000
See also: max_match_per_file, --timeout, --max-memory

The limit counts the matches of all rules in a file together. When a file has more, Opengrep drops all the findings of the file, of every rule, records a Too many matches error, and logs a warning that names the rule with the most matches:

most offending rule: id = find-eval, matches = 3, pattern = eval(...)

The file is counted as partially analyzed, and the scan continues with the other files.

The limit does not shorten the output: the findings of the file are dropped. To keep only the first findings of one rule, set the option max_match_per_file of the rule.

Examples

A rule that matches too often

rule.yaml

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

Command and result

$ printf 'eval(1)\neval(2)\neval(3)\n' > many.py
$ opengrep scan --config rule.yaml --json many.py 2>/dev/null | jq .
{
  "version": "X.Y.Z",
  "results": [
    {
      "check_id": "find-eval",
      "path": "many.py",
      "start": {
        "line": 1,
        "col": 1,
        "offset": 0
      },
      "end": {
        "line": 1,
        "col": 8,
        "offset": 7
      },
      "extra": {
        "metavars": {},
        "message": "found eval",
        "metadata": {},
        "severity": "WARNING",
        "fingerprint": "516e2365a1eeb419dad03622c4e7dd819f330ed97d9d0bfe1f405be794df9ee17b7566f637c5df8b1b4ad21d704b5b2e531dfe9cad3790f17c8f2abed7a23587_0",
        "lines": "eval(1)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    },
    {
      "check_id": "find-eval",
      "path": "many.py",
      "start": {
        "line": 2,
        "col": 1,
        "offset": 8
      },
      "end": {
        "line": 2,
        "col": 8,
        "offset": 15
      },
      "extra": {
        "metavars": {},
        "message": "found eval",
        "metadata": {},
        "severity": "WARNING",
        "fingerprint": "516e2365a1eeb419dad03622c4e7dd819f330ed97d9d0bfe1f405be794df9ee17b7566f637c5df8b1b4ad21d704b5b2e531dfe9cad3790f17c8f2abed7a23587_1",
        "lines": "eval(2)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    },
    {
      "check_id": "find-eval",
      "path": "many.py",
      "start": {
        "line": 3,
        "col": 1,
        "offset": 16
      },
      "end": {
        "line": 3,
        "col": 8,
        "offset": 23
      },
      "extra": {
        "metavars": {},
        "message": "found eval",
        "metadata": {},
        "severity": "WARNING",
        "fingerprint": "516e2365a1eeb419dad03622c4e7dd819f330ed97d9d0bfe1f405be794df9ee17b7566f637c5df8b1b4ad21d704b5b2e531dfe9cad3790f17c8f2abed7a23587_2",
        "lines": "eval(3)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    }
  ],
  "errors": [],
  "paths": {
    "scanned": [
      "many.py"
    ]
  },
  "interfile_languages_used": [],
  "skipped_rules": []
}
$ opengrep scan --config rule.yaml --json --max-match-per-file 2 many.py 2>/dev/null | jq .
{
  "version": "X.Y.Z",
  "results": [],
  "errors": [
    {
      "code": 2,
      "level": "warn",
      "type": "Too many matches",
      "rule_id": "find-eval",
      "message": "Too many matches when running find-eval on many.py:\n An error occurred while invoking the Opengrep engine. Please help us fix this by creating an issue at https://github.com/opengrep/opengrep\n\n1 rules result in too many matches, most offending rule has 3: eval(...)",
      "path": "many.py"
    }
  ],
  "paths": {
    "scanned": [
      "many.py"
    ]
  },
  "interfile_languages_used": [],
  "skipped_rules": []
}

two.yaml

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING  - id: find-exec    pattern: exec(...)    message: found exec    languages: [python]    severity: WARNING

two.py

eval(1)exec(1)

Command and result

$ opengrep scan --config two.yaml --json --max-match-per-file 1 two.py 2>/dev/null | jq .
{
  "version": "X.Y.Z",
  "results": [],
  "errors": [
    {
      "code": 2,
      "level": "warn",
      "type": "Too many matches",
      "rule_id": "find-eval",
      "message": "Too many matches when running find-eval on two.py:\n An error occurred while invoking the Opengrep engine. Please help us fix this by creating an issue at https://github.com/opengrep/opengrep\n\n2 rules result in too many matches, most offending rule has 1: eval(...)",
      "path": "two.py"
    }
  ],
  "paths": {
    "scanned": [
      "two.py"
    ]
  },
  "interfile_languages_used": [],
  "skipped_rules": []
}
$ opengrep scan --config two.yaml --json --max-match-per-file 2 two.py 2>/dev/null | jq .
{
  "version": "X.Y.Z",
  "results": [
    {
      "check_id": "find-eval",
      "path": "two.py",
      "start": {
        "line": 1,
        "col": 1,
        "offset": 0
      },
      "end": {
        "line": 1,
        "col": 8,
        "offset": 7
      },
      "extra": {
        "metavars": {},
        "message": "found eval",
        "metadata": {},
        "severity": "WARNING",
        "fingerprint": "fe58b530500822f323ac19d98001497d7b30bdd3f20e12468582ffdb71e028856c5375826cffee4912c0352a79e51f4c12b34804050a451f63903605ed54fb6e_0",
        "lines": "eval(1)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    },
    {
      "check_id": "find-exec",
      "path": "two.py",
      "start": {
        "line": 2,
        "col": 1,
        "offset": 8
      },
      "end": {
        "line": 2,
        "col": 8,
        "offset": 15
      },
      "extra": {
        "metavars": {},
        "message": "found exec",
        "metadata": {},
        "severity": "WARNING",
        "fingerprint": "628e39a4f93bc421a2802c802608f9fe43e4f6b93e15acebb3be020e0152756ca906608e5b9a391f98b424d2f5cb9d4dab5bef47f597f3438da956d1593d3d83_0",
        "lines": "exec(1)",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    }
  ],
  "errors": [],
  "paths": {
    "scanned": [
      "two.py"
    ]
  },
  "interfile_languages_used": [],
  "skipped_rules": []
}

Each rule matches once, but together they match twice: a limit of 1 drops both findings, and a limit of 2 keeps them.

--max-match-per-file

## Examples

### A rule that matches too often

### Two rules share the limit

`--max-match-per-file`

Examples

A rule that matches too often

Two rules share the limit