reference > Rule syntax

pattern-sinks

See also

mode: taint, pattern-sources, label, exact, focus-metavariable

The list of sinks of a taint rule. Each item is a mapping with a pattern, written with the keys of a search rule. A finding is reported where tainted data reaches the code that the pattern matches. A taint rule without pattern-sinks is invalid.

An item takes these keys besides its pattern:

A sink pattern usually matches a whole call, such as cursor.execute(...). A call is tainted when one of its arguments is. To report only the taint that reaches one argument, focus the sink on it with focus-metavariable.

## Examples

### Only the query argument

A parameterized query passes user input separately from the SQL text, and is safe. Focusing the sink on the first argument of execute keeps such calls out of the findings.

rules:  - id: sql-injection    mode: taint    pattern-sources:      - pattern: request.args.get(...)    pattern-sinks:      - patterns:          - pattern: cursor.execute($QUERY, ...)          - focus-metavariable: $QUERY    message: user input reaches the text of a SQL query    languages: [python]    severity: ERROR

name = request.args.get("name")# ok: sql-injectioncursor.execute("SELECT * FROM users WHERE name = %s", (name,))# ruleid: sql-injectioncursor.execute("SELECT * FROM users WHERE name = '" + name + "'")

$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.