reference > Rule syntax

focus-metavariable

See also

patterns, by-side-effect, pattern-sinks, $X

An item of patterns. It names a metavariable bound by the other items, and the finding is reported at the code that the metavariable matched instead of the whole match. The rule matches the same code; only the reported location changes. In a taint rule, it makes a source, a sanitizer or a sink the code of the metavariable, such as one argument of a call.

The value can be a list of metavariables, each of which then gives a finding of its own. Several focus-metavariable items instead narrow one finding to the code that all of them matched, and give no finding when they matched different code.

## Examples

### The command, not the call

rules:  - id: shell-command    patterns:      - pattern: subprocess.run($CMD, shell=True, ...)      - focus-metavariable: $CMD    message: the command run through a shell    languages: [python]    severity: WARNING

import subprocesssubprocess.run(    "tar czf " + name + ".tgz data/",    shell=True,    check=True,)

$ opengrep scan -q --config shell-command.yaml app.py
app.py

  warn  shell-command
  the command run through a shell

     4: "tar czf " + name + ".tgz data/",

### A list, and two items

rules:  - id: each-path    patterns:      - pattern: shutil.copy($SRC, $DST)      - focus-metavariable: [$SRC, $DST]    message: a path given to shutil.copy    languages: [python]    severity: INFO  - id: both-paths    patterns:      - pattern: shutil.copy($SRC, $DST)      - focus-metavariable: $SRC      - focus-metavariable: $DST    message: a path given to shutil.copy    languages: [python]    severity: INFO

import shutilshutil.copy(    upload_path,    target_path,)

$ opengrep scan -q --config copy.yaml app.py
app.py

  info  each-path
  a path given to shutil.copy

     4: upload_path,

     5: target_path,

each-path reports both arguments, as two findings under one heading. both-paths reports nothing, since $SRC and $DST matched different code.