reference Rule options

taint_only_propagate_through_assignments

Value
true or false
Default
false
See also
taint_assume_safe_functions

With taint_only_propagate_through_assignments: true, taint moves from one variable to another only by assignment, as in copy = data. Operators, function calls and method calls no longer propagate it, so data + "!", quote(data) and data.strip() are clean. Indexing with a tainted value does not propagate it either: table[data] is clean. The option is stricter than taint_assume_safe_functions and taint_assume_safe_indexes combined.

A list literal still carries the taint of its elements: [data] is tainted.

Examples

What still carries taint

The rule logged turns the option on.

logged.yaml
rules:  - id: logged-default    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: log(...)    message: user input is logged    languages: [python]    severity: WARNING  - id: logged    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: log(...)    message: user input is logged    languages: [python]    severity: WARNING    options:      taint_only_propagate_through_assignments: true
logged.py
data = input()copy = data# ruleid: logged-default, loggedlog(copy)items = [data]# ruleid: logged-default, loggedlog(items)# ruleid: logged-defaultlog(data + "!")# ruleid: logged-defaultlog(quote(data))stripped = data.strip()# ruleid: logged-defaultlog(stripped)# ruleid: logged-defaultlog(table[data])
Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.