reference Rule syntax

pattern-inside

See also
pattern-not-inside, patterns, <... ...>

An item of patterns. It keeps the matches of the other items that lie inside code matched by its own pattern, and drops the rest. The pattern usually describes the context, with an ellipsis for the part where the match can be, such as the body of a function or the statements after an assignment.

The metavariables bound in pattern-inside are shared with the other items of the same patterns, so that the context can bind a variable that the main pattern must use.

Examples

Inside a request handler

handler-shell.yaml
rules:  - id: handler-shell    patterns:      - pattern-inside: |          @app.route(...)          def $HANDLER(...):              ...      - pattern: os.system(...)    message: os.system in a request handler    languages: [python]    severity: ERROR
handler-shell.py
import osfrom flask import Flaskapp = Flask(__name__)@app.route("/backup")def backup():    # ruleid: handler-shell    os.system("tar czf /tmp/backup.tgz /srv/data")def nightly():    # ok: handler-shell    os.system("tar czf /tmp/backup.tgz /srv/data")
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.

A metavariable bound by the context

flask-debug.yaml
rules:  - id: flask-debug    patterns:      - pattern-inside: |          $APP = Flask(...)          ...      - pattern: $APP.run(..., debug=True, ...)    message: Flask app $APP runs with the debugger enabled    languages: [python]    severity: ERROR
flask-debug.py
from flask import Flaskapp = Flask(__name__)server = make_server()# ruleid: flask-debugapp.run(debug=True)# ok: flask-debugserver.run(debug=True)
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.