Rule options

The options key of a rule sets options that change how the rule matches; the other rules of the scan keep the defaults.

rules:
  - id: example
    pattern: ...
    options:
      symbolic_propagation: true

An unknown option makes the rule invalid: the run stops with exit status 2 and reports Found unknown JSON field <name>. An unknown key elsewhere in a rule produces only a warning.

Some options have a command-line flag that enables the same behavior for every rule of a scan. Such a flag cannot turn the option off for a rule that enables it.

Index

Name	Summary
`ac_matching`	Match chains of an associative operator as a flat list of operands.
`arrow_is_function`	Match arrow functions and function expressions like other functions.
`attr_expr`	Let a call pattern match a decorator or an annotation written like a call.
`commutative_boolop`	Match the operands of && and \|\| in any order.
`constant_propagation`	Let a literal in a pattern match a variable known to hold that value.
`cpp_parsing_pref`	Read an ambiguous C++ pattern such as foo $X(...); as a function declaration or a constructed variable.
`decorators_order_matters`	Require decorators and annotations to appear in the order the pattern gives.
`dynamic_timeout`	Scale the time limit of this rule with the size of the file; requires --allow-rule-timeout-control.
`dynamic_timeout_max_multiplier`	The largest factor of the dynamic timeout of this rule; requires --allow-rule-timeout-control.
`dynamic_timeout_unit_kb`	The file size, in KB, of one step of the dynamic timeout of this rule; requires --allow-rule-timeout-control.
`flddef_assign`	Let a pattern assigning a function match methods and fields that hold functions.
`generic_braces`	With aliengrep, replace the pairs of braces that an ellipsis keeps balanced.
`generic_caseless`	With aliengrep, match text regardless of letter case.
`generic_comment_style`	With spacegrep, remove comments of one style from the target before matching.
`generic_ellipsis_max_span`	With spacegrep, the maximum number of line breaks that an ellipsis may span.
`generic_engine`	The engine of rules for the generic language: spacegrep or aliengrep.
`generic_extra_braces`	With aliengrep, add pairs of braces that an ellipsis keeps balanced.
`generic_extra_word_characters`	With aliengrep, add characters that a metavariable may capture as part of a word.
`generic_multiline`	With aliengrep, whether an ellipsis may span several lines.
`go_deeper_expr`	Let deep expression patterns and statements look inside expressions.
`go_deeper_stmt`	Let ... between statements match statements nested in later blocks.
`guarded_taint_signatures`	Drop a cross-function taint finding when the branch leading to the sink cannot be taken.
`implicit_deep_exprstmt`	Let an expression statement in a statement pattern match a statement containing it.
`implicit_ellipsis`	Let a record or class pattern match targets with more fields than it lists.
`implicit_return`	Let a return pattern match the value a function returns without the return keyword.
`let_is_var`	Let a var declaration pattern match let and const declarations.
`max_match_per_file`	Keep only the first findings of this rule in each file.
`symbolic_propagation`	Let a variable assigned an expression match that expression.
`symmetric_eq`	Match the operands of == and != in either order.
`taint_assume_safe_booleans`	Assume that a boolean value is clean, even when it was computed from tainted data.
`taint_assume_safe_comparisons`	Assume that the result of a comparison is clean, even when an operand is tainted.
`taint_assume_safe_functions`	Assume that a call returns clean data, even when its arguments are tainted.
`taint_assume_safe_indexes`	Assume that a tainted index does not taint the element it selects.
`taint_assume_safe_numbers`	Assume that a number is clean, even when it was computed from tainted data.
`taint_focus_on`	Report a taint finding at the source instead of at the sink.
`taint_interfile`	Mark a taint rule for cross-file analysis under --enable-interfile.
`taint_interfile_depth`	The longest call chain that the cross-file taint analysis of this rule follows.
`taint_intrafile`	Follow taint through calls to functions defined in the same file.
`taint_only_propagate_through_assignments`	Propagate taint only through assignments, not through operators or calls.
`taint_unify_mvars`	Require a metavariable used in both a source and a sink to bind the same code in both.
`timeout`	The time limit of this rule on each file, in seconds; requires --allow-rule-timeout-control.
`unify_ids_strictly`	Require a metavariable bound twice to name the same variable, not only the same name.
`vardef_assign`	Let an assignment pattern match a variable declaration with an initial value.
`xml_attrs_implicit_ellipsis`	Let an XML pattern match elements with more attributes than it lists.
`xml_children_ordered`	Require the children of an XML element to appear in the order the pattern gives.
`xml_singleton_loose_matching`	Let a self-closing element and an element with open and close tags match each other.

Examples

A misspelled option stops the run

rule.yaml

rules:  - id: unsafe-query    pattern: $DB.cursor().execute(...)    message: raw SQL executed on a cursor    languages: [python]    severity: WARNING    options:      symbolic_propagatio: true

app.py

def query(db, sql):    cur = db.cursor()    cur.execute(sql)

Command and result

$ opengrep scan --config rule.yaml app.py 2>&1 | sed 's/ while expecting.*//'
error    Error: Found unknown JSON field symbolic_propagatio
$ opengrep scan --config rule.yaml app.py > /dev/null 2>&1; echo "exit status: $?"
exit status: 2

Rule options

## Index

## Examples

### A misspelled option stops the run

Index

Examples

A misspelled option stops the run