reference > Rule options

constant_propagation

Value

true or false

Default

true

See also

options, symbolic_propagation

A variable that is assigned a constant is matched as that constant. After path = "/etc/passwd", the pattern open("/etc/passwd") also matches open(path). Constant expressions are evaluated first, so a variable holding "/etc/" + "passwd" matches too. A variable that is assigned another value afterwards is no longer treated as constant.

With constant_propagation: false, a literal in a pattern matches only the literal itself. The option also controls two features that depend on it: metavariable-regex with constant-propagation: true, which then applies only to literals, and symbolic_propagation.

## Examples

### A path held in a variable

The rule passwd-file-default leaves the option on; passwd-file turns it off, and matches only the literal.

rules:  - id: passwd-file-default    pattern: open("/etc/passwd")    message: reads the password file    languages: [python]    severity: WARNING  - id: passwd-file    pattern: open("/etc/passwd")    message: reads the password file    languages: [python]    severity: WARNING    options:      constant_propagation: false

# ruleid: passwd-file-default, passwd-fileopen("/etc/passwd")path = "/etc/passwd"# ruleid: passwd-file-defaultopen(path)joined = "/etc/" + "passwd"# ruleid: passwd-file-defaultopen(joined)other = "/etc/passwd"other = input()# ok: passwd-file-defaultopen(other)

$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.