Internal and debugging interfaces
These interfaces exist for the development, testing and packaging of Opengrep. They may change or be removed in any release.
opengrep --core
The Opengrep binary also contains the command-line interface of the engine, which runs when the first argument is --core; opengrep --core -help lists its options. The opengrep commands are built on the same engine. The engine appends the whitespace-separated words of OPENGREP_CORE_EXTRA (or SEMGREP_CORE_EXTRA) to its own arguments.
opengrep show dump commands
opengrep show prints internal representations with dump-config, dump-rule, dump-rule-v2, dump-patterns-of-rule, dump-ast, dump-il, dump-il-pp, dump-cst, dump-pattern, dump-intrafile-graph, dump-interfile-graph and dump-taint-signatures. opengrep show --help describes their arguments.
Flags
| Flag | Purpose |
|---|---|
--develop | Enables features under development. |
--dump-ast | Prints the AST of the target instead of scanning (with -e/--lang). |
--profile | Collects and prints profiling information. |
--x-ls, --x-ls-long | Lists the files a scan would consider, instead of scanning. |
--x-ignore-semgrepignore-files | Ignores .semgrepignore files. |
Environment variables
| Variable | Purpose |
|---|---|
OPENGREP_IN_TEST | Set by the test suite of Opengrep. |
OPENGREP_IN_DOCKER | Set in the Docker image of Opengrep. |
OPENGREP_PROJIDX_BATCH | Batch size of the project index. Read only under this name, with no SEMGREP_ alias. |
OPENGREP_FAIL_OPEN_URL | Not used. |
OPENGREP_GHA_MIN_FETCH_DEPTH | Deprecated: minimum git fetch depth for opengrep ci on GitHub Actions. |
OPENGREP_BRANCH, OPENGREP_COMMIT, OPENGREP_JOB_URL, OPENGREP_PR_TITLE, OPENGREP_REPO_DISPLAY_NAME, OPENGREP_REPO_URL, and their SEMGREP_ names | For opengrep ci: the branch, commit, CI job URL, pull request title, repository display name and repository URL, recorded in the metadata of the scan. |
PYTEST_OPENGREP_LOG_*, PYTEST_SEMGREP_LOG_* | Log settings for test runners that clear the environment except PYTEST_*. They take precedence over OPENGREP_LOG_LEVEL and the related variables. |
GITHUB_*, GH_TOKEN, GITLAB_CI, CI_*, CIRCLECI, CIRCLE_*, BUILDKITE, BUILDKITE_*, TRAVIS, TRAVIS_*, JENKINS_URL, GIT_URL, GIT_URL_1, GIT_BRANCH, GIT_COMMIT, BUILD_*, BITBUCKET_*, SYSTEM_* | Set by CI providers. opengrep ci reads them to detect the provider, the repository, the branch and the pull request. |
Rule options
| Option | Purpose |
|---|---|
taint_fixpoint_timeout | For taint rules: intended to limit the time spent on the analysis of one function. |
Rule keys
Rule keys starting with semgrep-internal- or r2c-internal- are internal, among them semgrep-internal-metavariable-name with its keys metavariable, kind, module and modules. A rule that uses r2c-internal-project-depends-on, a key of supply-chain rules, is invalid.
| Key | Purpose |
|---|---|
equivalences | Declares code equivalences for the patterns of a rule. |
base | In metavariable-comparison: intended to set the base of integer literals. |
at-exit | In pattern-sinks: intended to mark sinks at the exit of a function. |
mode: extract, with extract, dest-language, dest-rules, transform and reduce | Intended for code embedded in a file, such as a script in a YAML file, to be scanned as another language. |
mode: step, with steps | Intended for rules made of several steps. |
pattern-where-python | A rule that uses it is invalid. |
The second rule syntax
Opengrep also parses an experimental second syntax for rules, in which a rule matches with match: instead of pattern: and patterns:, and combines conditions with all, any, not, inside, anywhere, as, where and focus. A taint rule written in it uses a taint: block with sources, sinks, sanitizers and propagators.