reference Rule syntax

mode

See also
mode: taint, pattern

Selects how the rule finds code:

ValueThe rule
searchMatches code with one of pattern, pattern-either, patterns or pattern-regex. The default.
taintFollows data from sources to sinks; see mode: taint.

The values extract and step are internal. Any other value makes the rule invalid.

Examples

search is the default

search.yaml
rules:  - id: find-eval-default    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING  - id: find-eval    mode: search    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
search.py
# ruleid: find-eval-default, find-evaleval(expression)
Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.

An unknown mode

rule.yaml
rules:  - id: find-eval    mode: find    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(expression)
Command and result
$ opengrep scan --config rule.yaml app.py > /dev/null 2>&1; echo "exit status: $?"
exit status: 7