by-side-effect
A key of the items of pattern-sources, pattern-sanitizers and pattern-propagators. It determines whether the item affects only the code it matches, or also the variable it matches in the code that follows, as a function that writes into its argument does.
| Item | Values | Default | Effect |
|---|---|---|---|
| Source | true, false, only | false | true also taints the matched variable after the match. only taints it after the match, but not the matched code itself. |
| Sanitizer | true, false | false | true also sanitizes the matched variable after the match. |
| Propagator | true, false | true | false taints the to value only where the pattern matches, not in the code that follows. |
A source or a sanitizer that works by side effect usually matches a variable, picked out of a call with focus-metavariable.
Examples
A function that fills a buffer
read_request(buf) writes the request into buf. By default, only the occurrence of buf in the call is tainted: the call is tainted, since one of its arguments is, but buf is not tainted in the code that follows.
fill-buffer.yaml
rules: - id: fill-buffer-default mode: taint pattern-sources: - patterns: - pattern: read_request($BUF) - focus-metavariable: $BUF pattern-sinks: - pattern: os.system(...) message: request data reaches os.system languages: [python] severity: ERROR - id: fill-buffer mode: taint pattern-sources: - patterns: - pattern: read_request($BUF) - focus-metavariable: $BUF by-side-effect: true pattern-sinks: - pattern: os.system(...) message: request data reaches os.system languages: [python] severity: ERRORfill-buffer.py
import osbuf = bytearray()# ruleid: fill-buffer-default, fill-bufferos.system(read_request(buf))# ruleid: fill-bufferos.system(buf.decode())Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.A check that validates its argument
validate.yaml
rules: - id: validate-default mode: taint pattern-sources: - pattern: request.args.get(...) pattern-sanitizers: - patterns: - pattern: validate_hostname($X) - focus-metavariable: $X pattern-sinks: - pattern: os.system(...) message: user input reaches os.system languages: [python] severity: ERROR - id: validate mode: taint pattern-sources: - pattern: request.args.get(...) pattern-sanitizers: - patterns: - pattern: validate_hostname($X) - focus-metavariable: $X by-side-effect: true pattern-sinks: - pattern: os.system(...) message: user input reaches os.system languages: [python] severity: ERRORvalidate.py
import oshost = request.args.get("host")# ruleid: validate-default, validateos.system("ping -c 1 " + host)validate_hostname(host)# ruleid: validate-defaultos.system("ping -c 1 " + host)Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.