reference Rule options

taint_assume_safe_indexes

Value
true or false
Default
false
See also
taint_assume_safe_functions

By default, commands[choice] is tainted when the index choice is. With taint_assume_safe_indexes: true, a tainted index leaves the element clean.

An element of a tainted collection is still tainted: words[0] is tainted when words is.

Examples

A tainted index and a tainted list

The rule shell turns the option on.

shell.yaml
rules:  - id: shell-default    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR  - id: shell    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR    options:      taint_assume_safe_indexes: true
shell.py
import oscommands = {"list": "ls", "where": "pwd"}choice = input()# ruleid: shell-defaultos.system(commands[choice])words = input()# ruleid: shell-default, shellos.system(words[0])
Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.