pattern-propagators
- See also
mode: taint,label,by-side-effect
The list of propagators of a taint rule. A propagator declares that some code passes taint from one value to another, where the analysis does not detect it, such as a method that stores its argument in the object it is called on. Each item has a pattern with two metavariables and the keys from and to, which name them: when the pattern matches and the value of from is tainted, the value of to becomes tainted too.
An item takes these keys besides its pattern:
| Key | Effect |
|---|---|
from | The metavariable whose taint is passed on. Required. |
to | The metavariable that receives the taint. Required. |
by-side-effect | false taints the to value only where the pattern matches; by default, it stays tainted in the code that follows. |
label | Give the taint that is passed on this label instead of its own. |
replace-labels | With label: relabel only the taint that carries one of these labels, and pass on the other taint unchanged. |
requires | Pass on only the taint that carries the given labels. |
Examples
A builder that collects arguments
command-builder.yaml
rules: - id: command-builder mode: taint pattern-sources: - pattern: request.args.get(...) pattern-propagators: - pattern: $TO.add_arg($FROM) from: $FROM to: $TO pattern-sinks: - pattern: os.system(...) message: user input reaches os.system languages: [python] severity: ERRORcommand-builder.py
import osdef run(): host = request.args.get("host") cmd = CommandBuilder("ping") cmd.add_arg(host) # ruleid: command-builder os.system(cmd.build())Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.Without the propagator, cmd is not tainted by the call cmd.add_arg(host), and the rule reports nothing.