reference Pattern syntax

String literals: "..."

See also
..., $X, metavariable-regex, pattern-regex

A string literal in a pattern matches the same string in the code, whichever quotes it is written with. Three forms match more than one string:

PatternMatches
"..."Any string literal.
"$S"Any string literal, bound to $S.
"=~/REGEX/"A string literal whose content matches the PCRE regular expression REGEX.

These forms match string literals only. A string built at run time, such as an f-string or a concatenation, is an expression: match it with an expression pattern such as "..." + $X.

Examples

A hard-coded password

hardcoded-password.yaml
rules:  - id: hardcoded-password    pattern: connect(..., password="...", ...)    message: a database password is hard-coded    languages: [python]    severity: ERROR
hardcoded-password.py
# ruleid: hardcoded-passworddb = connect(host="db", password="hunter2")# ok: hardcoded-passworddb = connect(host="db", password=os.environ["DB_PASSWORD"])
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.

A string that matches a regular expression

http-url.yaml
rules:  - id: http-url    pattern: requests.get("=~/^http:\/\//", ...)    message: a request is sent over plain HTTP    languages: [python]    severity: WARNING
http-url.py
# ruleid: http-urlrequests.get("http://api.example.com/users")# ok: http-urlrequests.get("https://api.example.com/users")
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.