reference Rule syntax

id

See also
--rewrite-rule-ids, --exclude-rule, rules

Identifies the rule. Every rule must have an id. The findings of a rule carry its id, and flags such as --exclude-rule select rules by it.

An id consists of letters, digits, ., _ and -. A rule whose id contains any other character is invalid.

When a rule file is in a subdirectory of the current directory, Opengrep prefixes the ids of its rules with the path of that directory, with dots in place of the slashes: the rule find-eval in rules/eval.yaml is reported as rules.find-eval. --no-rewrite-rule-ids keeps the ids as written.

Ids must be unique within a scan. When two rules have the same id, the second one is ignored, with a warning.

Examples

The id in a finding

rules/eval.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(user_input)
Command and result
$ opengrep scan -q --config rules/eval.yaml app.py
app.py

  warn  rules.find-eval
  found eval

     1: eval(user_input)
$ opengrep scan -q --config rules/eval.yaml --no-rewrite-rule-ids app.py
app.py

  warn  find-eval
  found eval

     1: eval(user_input)

Two rules with the same id

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING  - id: find-eval    pattern: eval($X)    message: found eval with one argument    languages: [python]    severity: WARNING
app.py
eval(user_input)
Command and result
$ opengrep scan --config rule.yaml app.py 2>&1 >/dev/null | grep warning
warning  Duplicated rule id. Rule 'find-eval' (rule.yaml:7:8) will be ignored.

A character that an id cannot contain

rule.yaml
rules:  - id: find eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
Command and result
$ opengrep validate rule.yaml 2>&1 | grep 'valid rule ID'
         Expected a valid rule ID at id. Got find eval