reference Rule syntax

control

See also
pattern-sources, mode: taint

A key of the items of pattern-sources, with the value true or false, false by default. With control: true, the source does not taint data but the flow of control: every sink that the program can reach after the source is reported, regardless of the data it receives.

Such a rule reports an operation that must not happen after another one, rather than a flow of data.

Examples

Session data read after logout

after-logout.yaml
rules:  - id: after-logout    mode: taint    pattern-sources:      - pattern: logout(...)        control: true    pattern-sinks:      - pattern: session.get(...)    message: session data is read after the user logged out    languages: [python]    severity: WARNING
after-logout.py
def sign_out(request):    # ok: after-logout    name = session.get("user")    logout(request)    # ruleid: after-logout    audit(session.get("user"), "signed out")
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.