reference Rule options

taint_interfile_depth

Value
an integer
See also
--interfile-depth, taint_interfile

Sets how many calls deep the cross-file taint analysis follows a call chain for this rule. A negative value removes the limit. The option applies to rules that set taint_interfile, in scans run with --enable-interfile; otherwise it has no effect.

A depth set by the rule takes precedence over --interfile-depth, whether it is larger or smaller. A rule that does not set it uses the flag's value, 3 by default.

Examples

A chain of three calls

rule.yaml
rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: input reaches os.system    languages: [python]    severity: ERROR    options:      taint_interfile: true
deep.yaml
rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: input reaches os.system    languages: [python]    severity: ERROR    options:      taint_interfile: true      taint_interfile_depth: 3
unlimited.yaml
rules:  - id: input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: os.system(...)    message: input reaches os.system    languages: [python]    severity: ERROR    options:      taint_interfile: true      taint_interfile_depth: -1
d.py
import osdef sink_it(cmd):    os.system(cmd)
c.py
from d import sink_itdef step_c(x):    sink_it(x)
b.py
from c import step_cdef step_b(x):    step_c(x)
a.py
from b import step_bstep_b(input())
Command and result
$ opengrep scan -q --config rule.yaml --enable-interfile --interfile-depth 2 --files-with-matches .
$ opengrep scan -q --config deep.yaml --enable-interfile --interfile-depth 2 --files-with-matches .
d.py
$ opengrep scan -q --config unlimited.yaml --enable-interfile --interfile-depth 1 --files-with-matches .
d.py

The first rule does not set a depth, so the flag's depth of 2 applies; it is too short for the chain, and the first scan reports nothing. The other two rules set their own depth, which takes precedence over the flag.