reference Rule syntax

pattern-regex

See also
pattern-not-regex, pattern, metavariable-regex, languages, patterns, "..."

Matches a PCRE regular expression against the text of the file instead of its syntax. It finds what a code pattern cannot, such as a token format, a word in a comment, or text in a file of any language.

A named group, (?P<NAME>...), binds the metavariable $NAME to the text it matched, for use in the message or in the other items of patterns.

pattern-regex can stand at the top of a rule, as an item of patterns, or as an alternative in pattern-either. A rule for the language regex, which has no syntax to match, uses it.

Examples

An AWS access key in the source

aws-key.yaml
rules:  - id: aws-key    pattern-regex: AKIA[0-9A-Z]{16}    message: an AWS access key id in the source    languages: [python]    severity: ERROR
aws-key.py
import os# ruleid: aws-keyACCESS_KEY = "AKIAIOSFODNN7EXAMPLE"# ok: aws-keyACCESS_KEY = os.environ["AWS_ACCESS_KEY_ID"]
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.

A named group in the message

rule.yaml
rules:  - id: aws-key    pattern-regex: (?P<KEY>AKIA[0-9A-Z]{16})    message: AWS access key id $KEY in the source    languages: [python]    severity: ERROR
app.py
ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE"
Command and result
$ opengrep scan -q --config rule.yaml app.py
app.py

  error  aws-key
  AWS access key id AKIAIOSFODNN7EXAMPLE in the source

     1: ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE"