reference > Flags

--taint-intrafile

Accepted by

opengrep scan, opengrep ci, opengrep test

See also

taint_intrafile, mode: taint, --enable-interfile, --guarded-taint-signatures, --disable-intrafile

By default, a taint rule analyzes one function at a time: taint passed to another function is not followed into it. This flag enables the analysis across the functions of each file, for every taint rule of the scan. Opengrep computes a summary of what each function does with its arguments and applies the summaries at the calls, regardless of the length of the chain of calls.

The finding is reported at the sink, inside the function that contains it, not at the call that starts the chain.

The rule option taint_intrafile enables the same analysis for one rule. The flag can only turn the analysis on; a rule cannot turn it off.

The supported languages are Apex, C, C++, C#, Clojure, Dart, Elixir, Go, Java, JavaScript, Julia, Kotlin, Lua, Python, Ruby, Rust, Scala, Swift, TypeScript and Visual Basic. For other languages, Opengrep logs a warning and analyzes each function on its own.

## Examples

### A chain of calls in one file

rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: input reaches os.system    languages: [python]    severity: ERROR

import osdef a(x):    os.system(x)def b(x):    a(x)def c(x):    b(x)def d(x):    c(x)d(input())

$ opengrep scan -q --config rule.yaml chain.py
$ opengrep scan -q --config rule.yaml --taint-intrafile chain.py
chain.py

  error  input-to-system
  input reaches os.system

     4: os.system(x)

The first command prints nothing: without the flag, the taint is not followed into the call to c.