pattern-sources
- See also
mode: taint,pattern-sinks,label,exact,by-side-effect,control
The list of sources of a taint rule. Each item is a mapping with a pattern, written with the keys of a search rule, such as pattern, patterns or pattern-either. The data that the pattern matches is tainted. A taint rule without pattern-sources is invalid.
An item takes these keys besides its pattern:
| Key | Effect |
|---|---|
label | The label of the taint, __SOURCE__ when absent. |
requires | Apply the source only to data that already carries the given labels. |
exact | true taints only the matched code itself; by default, the code inside it is tainted as well. |
by-side-effect | Also taint the matched variable in the code that follows. |
control | Taint the flow of control instead of the data. |
With focus-metavariable, a source can be a parameter, such as a parameter of a request handler, rather than the whole function.
Examples
A parameter as the source
handler-param.yaml
rules: - id: handler-param mode: taint pattern-sources: - patterns: - pattern-inside: | @app.route(...) def $HANDLER(..., $PARAM, ...): ... - pattern: $PARAM pattern-sinks: - pattern: os.system(...) message: a route parameter reaches os.system languages: [python] severity: ERRORhandler-param.py
import os@app.route("/ping/<host>")def ping(host): # ruleid: handler-param os.system("ping -c 1 " + host)def helper(host): # ok: handler-param os.system("ping -c 1 " + host)Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.