metavariable-analysis
- See also
patterns
An item of patterns. It keeps the matches where the code bound to a metavariable passes an analysis. The value is a mapping:
metavariable: the metavariable, bound by another item;analyzer: the analysis to run: -entropy: the value looks random, as an API token or a key does, rather than like words; -redos: the value is a regular expression open to catastrophic backtracking, which an attacker can exploit with a crafted input.
Any other analyzer is an error, Unsupported analyzer.
Examples
A string that looks like a secret
high-entropy-secret.yaml
rules: - id: high-entropy-secret patterns: - pattern: $NAME = "$VALUE" - metavariable-analysis: metavariable: $VALUE analyzer: entropy message: a string that looks like a secret languages: [python] severity: WARNINGhigh-entropy-secret.py
# ruleid: high-entropy-secretapi_token = "ghp_7Hq2xV9kLmP4sT8wZ3nR6yB1cF5jD0aE"# ok: high-entropy-secretgreeting = "hello world"Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.A regular expression open to ReDoS
redos.yaml
rules: - id: redos patterns: - pattern: re.compile("$RE") - metavariable-analysis: metavariable: $RE analyzer: redos message: a regex open to catastrophic backtracking languages: [python] severity: WARNINGredos.py
import re# ruleid: redosre.compile("^(a+)+$")# ok: redosre.compile("^[a-z]+$")Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.