reference Rule options

taint_interfile

Also spelled
interfile
Value
true or false
Default
false
See also
--enable-interfile, --interfile-depth, taint_interfile_depth, --interfile-timeout, taint_intrafile, mode: taint, --interfile-dedup-by

Marks a taint rule for cross-file analysis. When the scan is run with --enable-interfile, the rule follows taint through calls to functions defined in other files of the project, and through calls within each file, as taint_intrafile does. Without the flag, the rule runs as if the option were absent.

With --enable-interfile, Opengrep builds a call graph of the project. When a file has sources but no sinks, or sinks but no sources, the files it is connected to in the graph are analyzed together with it, following call chains up to taint_interfile_depth calls long, or --interfile-depth when the rule does not set a depth. --interfile-timeout limits the time spent on the analysis. A finding is reported at the sink.

interfile: true is an alias of the option. A rule that sets both interfile and taint_interfile is invalid.

Examples

Taint across two files

rule.yaml
rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR    options:      taint_interfile: true
util.py
import osdef run(cmd):    os.system(cmd)
main.py
from util import runrun(input())
Command and result
$ opengrep scan -q --config rule.yaml .
$ opengrep scan -q --config rule.yaml --enable-interfile .
util.py

  error  input-to-system
  user input reaches os.system

     4: os.system(cmd)

  from: main.py
     3: input()

Without --enable-interfile, the first scan analyzes each file on its own and reports nothing.

Both names set

rule.yaml
rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR    options:      interfile: true      taint_interfile: true
Command and result
$ opengrep scan --config rule.yaml . 2>&1 | grep 'only one'
         only one of interfile and taint_interfile can be set