reference > Rule syntax

pattern

See also

patterns, pattern-either, pattern-regex, --pattern, mode, ..., imports and aliases

A piece of code in the language of the rule. Opengrep matches it against the syntax of the target, so line breaks, spacing and comments make no difference. Placeholders make a pattern match more than one piece of code, most often metavariables, such as $URL, which match any expression, and the ellipsis, ..., which matches any sequence of arguments, statements or elements.

A pattern can stand at the top of a rule, as an item of patterns, or as an alternative in pattern-either. A rule has exactly one of pattern, pattern-either, patterns and pattern-regex at its top level. A pattern of several lines is written as a YAML block scalar, after |.

A rule for the language regex has no syntax to match, and pattern is an error in it; such a rule uses pattern-regex.

## Examples

### A keyword argument anywhere in the call

rules:  - id: no-verify    pattern: requests.get($URL, ..., verify=False, ...)    message: TLS certificate verification is disabled    languages: [python]    severity: WARNING

import requests# ruleid: no-verifyrequests.get(url, verify=False)# ruleid: no-verifyrequests.get(url, timeout=5, verify=False)# ok: no-verifyrequests.get(url, timeout=5)

$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.

### The same metavariable twice

rules:  - id: self-compare    pattern: $X == $X    message: $X is compared with itself    languages: [python]    severity: WARNING

# ruleid: self-compareif token == token:    pass# ok: self-compareif token == expected:    pass

$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.