reference Rule syntax

pattern-not

See also
patterns, pattern-not-inside, pattern-not-regex

An item of patterns. It drops the matches of the other items that its own pattern matches as well.

It is a negative item: it cannot stand at the top of a rule or among the alternatives of pattern-either, and a patterns list needs at least one positive item next to it.

Examples

A shell command that is not a fixed string

shell-with-input.yaml
rules:  - id: shell-with-input    patterns:      - pattern: subprocess.run($CMD, shell=True, ...)      - pattern-not: subprocess.run("...", shell=True, ...)    message: a shell command built at run time    languages: [python]    severity: ERROR
shell-with-input.py
import subprocessdef archive(name):    # ruleid: shell-with-input    subprocess.run("tar czf " + name + ".tgz data/", shell=True)    # ok: shell-with-input    subprocess.run("tar czf backup.tgz data/", shell=True)
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.