reference Rule options

taint_assume_safe_functions

Value
true or false
Default
false
See also
mode: taint, taint_assume_safe_indexes, pattern-sanitizers, taint_only_propagate_through_assignments

By default, a taint rule assumes that a call returns tainted data when one of its arguments is tainted, and that a method called on a tainted object does too: quote(name) and name.strip() are tainted when name is.

With taint_assume_safe_functions: true, the result of such a call is clean. Operators still propagate taint, so "ls " + name stays tainted, and a tainted argument passed straight to a sink is still reported.

Functions that Opengrep analyzes are an exception. With taint_intrafile, a call to a function defined in the same file still returns the taint its body passes on.

Examples

Calls that take tainted data

The rule shell turns the option on.

shell.yaml
rules:  - id: shell-default    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR  - id: shell    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR    options:      taint_assume_safe_functions: true
shell.py
import osname = input()# ruleid: shell-default, shellos.system("ls " + name)# ruleid: shell-defaultos.system(quote(name))stripped = name.strip()# ruleid: shell-defaultos.system(stripped)
Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.

A function defined in the same file

wrapped.yaml
rules:  - id: wrapped    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR    options:      taint_intrafile: true      taint_assume_safe_functions: true
wrapped.py
import osdef listing(path):    return "ls " + pathname = input()# ruleid: wrappedos.system(listing(name))# ok: wrappedos.system(quote(name))
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.

listing is defined in the file, so its result keeps the taint of name; quote is not, so its result is assumed clean.