reference > Pattern syntax

Deep expressions: <... ...>

See also

..., $X, pattern-inside

<... P ...> matches an expression that contains code matching the pattern P, at any depth: the expression itself, one of its operands, an argument of a call within it, and so on. It is written where an expression is expected, most often as an argument:

cursor.execute(<... request.args.get(...) ...>)

matches a call to cursor.execute whose argument contains a call to request.args.get, however the argument is built from it: concatenated, formatted or passed through other calls.

## Examples

### A request parameter anywhere in the query

rules:  - id: query-from-request    pattern: cursor.execute(<... request.args.get(...) ...>)    message: a request parameter is part of a SQL query    languages: [python]    severity: ERROR

# ruleid: query-from-requestcursor.execute("SELECT * FROM users WHERE name = '" + request.args.get("name") + "'")# ruleid: query-from-requestcursor.execute(f"SELECT * FROM users WHERE id = {int(request.args.get('id'))}")# ok: query-from-requestcursor.execute("SELECT * FROM users WHERE name = %s", (name,))

$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.

Unlike a taint rule, the pattern matches only what is written inside the call: a parameter read into a variable on an earlier line is not matched.