reference Rule syntax

pattern-sanitizers

See also
mode: taint, exact, by-side-effect, taint_assume_safe_functions

The list of sanitizers of a taint rule. Each item is a mapping with a pattern, written with the keys of a search rule. The data that a sanitizer matches is not tainted, even when it is computed from tainted data, so taint that passes through a sanitizer does not reach a sink.

An item takes these keys besides its pattern:

KeyEffect
exacttrue sanitizes only the matched code itself; by default, the code inside it is sanitized as well.
by-side-effectAlso sanitize the matched variable in the code that follows.
not_conflictingtrue drops the sanitizer wherever it matches the same code as a source or a sink.

not_conflicting makes broad sanitizers possible. A sanitizer $F(...) treats every call as safe, including the call of a sink, which then never reports a finding; with not_conflicting: true, the calls that are sources or sinks are left out of it.

Examples

Quoting a shell argument

user-input-to-system.yaml
rules:  - id: user-input-to-system    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sanitizers:      - pattern: shlex.quote(...)    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR
user-input-to-system.py
import os, shlexname = input()# ok: user-input-to-systemos.system("ls " + shlex.quote(name))# ruleid: user-input-to-systemos.system("ls " + name)
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.

Every other call is safe

only-direct-flows.yaml
rules:  - id: only-direct-flows    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sanitizers:      - pattern: $F(...)        not_conflicting: true    pattern-sinks:      - pattern: os.system(...)    message: user input reaches os.system    languages: [python]    severity: ERROR
only-direct-flows.py
import osname = input()# ok: only-direct-flowsos.system(normalize(name))# ruleid: only-direct-flowsos.system("ls " + name)
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.

Without not_conflicting, the sanitizer would also match os.system(...), and the rule would report nothing.