reference Rule options

taint_assume_safe_comparisons

Value
true or false
Default
false

By default, an operation on tainted data gives a tainted result, and a comparison is no exception: answer == "yes" is tainted when answer is.

With taint_assume_safe_comparisons: true, the result of a comparison is clean. In Python that covers ==, !=, <, >=, in and is, among others. Operators that are not comparisons, such as + and not, still propagate taint.

Examples

Comparisons on user input

The rule logged turns the option on.

logged.yaml
rules:  - id: logged-default    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: log(...)    message: user input is logged    languages: [python]    severity: WARNING  - id: logged    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: log(...)    message: user input is logged    languages: [python]    severity: WARNING    options:      taint_assume_safe_comparisons: true
logged.py
answer = input()# ruleid: logged-default, loggedlog(answer + "!")# ruleid: logged-default, loggedlog(not answer)# ruleid: logged-defaultlog(answer == "yes")# ruleid: logged-defaultlog(answer != "no")# ruleid: logged-defaultlog(len(answer) >= 3)# ruleid: logged-defaultlog(answer in choices)# ruleid: logged-defaultlog(answer is None)
Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.