exact
- See also
pattern-sources,pattern-sanitizers,pattern-sinks
A key of the items of pattern-sources, pattern-sanitizers and pattern-sinks, with the value true or false. It determines whether the item applies to the code its pattern matches as a whole, or also to each piece of code inside it.
| Item | Default | With exact: true | With exact: false |
|---|---|---|---|
| Source | false | Only the matched code is tainted. | The code inside the match is tainted too. |
| Sanitizer | false | Only the matched code is sanitized. | The code inside the match is sanitized too. |
| Sink | true | A finding needs the matched code as a whole to be tainted. | Tainted data anywhere inside the match is a finding. |
For a sink sink(...), the default reports sink(name) but not sink("a" if name else "b"), whose value does not depend on the data of name even though name occurs inside it.
Examples
An exact source
load(...) is a source. By default, the code inside a call to load is a source as well, so open(path) in load(open(path)) is tainted and is reported as a sink. With exact: true, only the result of load is tainted.
exact-source.yaml
rules: - id: exact-source-default mode: taint pattern-sources: - pattern: load(...) pattern-sinks: - pattern: open(...) message: loaded data is opened as a file languages: [python] severity: ERROR - id: exact-source mode: taint pattern-sources: - pattern: load(...) exact: true pattern-sinks: - pattern: open(...) message: loaded data is opened as a file languages: [python] severity: ERRORexact-source.py
# ruleid: exact-source-defaultdata = load(open(path))# ruleid: exact-source-default, exact-sourceopen(load(path))Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.A sink that is not exact
exact-sink.yaml
rules: - id: exact-sink-default mode: taint pattern-sources: - pattern: request.args.get(...) pattern-sinks: - pattern: log(...) message: user input reaches the log languages: [python] severity: WARNING - id: exact-sink mode: taint pattern-sources: - pattern: request.args.get(...) pattern-sinks: - pattern: log(...) exact: false message: user input reaches the log languages: [python] severity: WARNINGexact-sink.py
name = request.args.get("name")# ruleid: exact-sinklog("known" if name in users else "unknown")# ruleid: exact-sink-default, exact-sinklog(name)Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.