reference Pattern syntax

Ellipsis: ...

See also
$X, <... ...>, pattern, "..."

The ellipsis matches any sequence, including an empty one. What it stands for depends on where it is written:

PatternMatches
foo(...)A call to foo with any arguments.
foo($X, ...)A call to foo with at least one argument.
foo(..., verify=False, ...)A call to foo that passes verify=False, at any position.
[..., $X, ...], {..., "key": $V, ...}A list containing $X, a dictionary with the key "key".
def $F(...): ...A function definition with any parameters and any body.
$A followed by ... and $B, on separate linesThe statement $A, then any statements, then $B.
$X. ... .hexdigest()A chain of calls that ends with .hexdigest().
"..."Any string literal; see strings.

In a sequence of statements, the ellipsis matches the statements in between, regardless of their number, including statements inside nested blocks.

Keyword arguments match in any order: foo(x=1, y=2) also matches foo(y=2, x=1).

Examples

Arguments in any position

no-verify.yaml
rules:  - id: no-verify    pattern: requests.$METHOD(..., verify=False, ...)    message: TLS certificate verification is disabled    languages: [python]    severity: WARNING
no-verify.py
import requests# ruleid: no-verifyrequests.get(url, verify=False)# ruleid: no-verifyrequests.post(url, data=body, verify=False, timeout=5)# ok: no-verifyrequests.get(url, timeout=5)
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.

Statements in between

unclosed-file.yaml
rules:  - id: read-then-close    pattern: |      $F = open(...)      ...      $F.close()    message: the file is closed explicitly; prefer a with statement    languages: [python]    severity: INFO
unclosed-file.py
# ruleid: read-then-closef = open(path)data = f.read()if not data:    log("empty file")f.close()
Command and result
$ opengrep scan -q --config unclosed-file.yaml unclosed-file.py
unclosed-file.py

  info  read-then-close
  the file is closed explicitly; prefer a with statement

     2: f = open(path)
     3: data = f.read()
     4: if not data:
     5:     log("empty file")
     6: f.close()

A finding spans the code that the whole pattern matches, from the first statement to the last.