reference > Rule syntax

fix

See also

--autofix, --dryrun, fix-regex, opengrep test, --replacement

The code that replaces each match of the rule. The metavariables in it are replaced by the code they matched. --autofix writes the fixes to the files; with --dryrun as well, the text output shows the fixed code under each finding and the files are not changed.

opengrep test checks the fix of a rule when the target x.js has a file x.fixed.js next to it: it applies the fix to x.js and compares the result with x.fixed.js.

## Examples

### innerHTML to textContent

rules:  - id: inner-html    pattern: $EL.innerHTML = $VALUE    fix: $EL.textContent = $VALUE    message: assigning to innerHTML can run injected scripts    languages: [javascript]    severity: WARNING

function showComment(el, comment) {  // ruleid: inner-html  el.innerHTML = comment;}

function showComment(el, comment) {  // ruleid: inner-html  el.textContent = comment;}

$ opengrep test .
1/1: ✓ All tests passed
1/1: ✓ All fix tests passed
$ opengrep scan -q --config inner-html.yaml --autofix --dryrun inner-html.js
inner-html.js

  warn  inner-html
  assigning to innerHTML can run injected scripts

     3: el.textContent = comment;
   fix: el.textContent = comment