Imports and aliases
Opengrep resolves the names in the target through its imports. A pattern that names a function by its full name, such as subprocess.call(...), also matches a call to the same function through an alias or a direct import:
| Code | Matched by subprocess.call(...) |
|---|---|
import subprocess then subprocess.call(cmd) | yes |
import subprocess as sp then sp.call(cmd) | yes |
from subprocess import call then call(cmd) | yes |
A pattern written with the short name, call(...), matches every call to a function named call, imported or not.
Examples
The same function under three names
shell-true.yaml
rules: - id: shell-true pattern: subprocess.call(..., shell=True, ...) message: a command is run through the shell languages: [python] severity: WARNINGshell-true.py
import subprocessimport subprocess as spfrom subprocess import call# ruleid: shell-truesubprocess.call(cmd, shell=True)# ruleid: shell-truesp.call(cmd, shell=True)# ruleid: shell-truecall(cmd, shell=True)# ok: shell-truesubprocess.call(["ls", path])Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.