Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Confusion when using multiple pattern-either inside patterns #828

Closed
inkz opened this issue May 25, 2020 · 2 comments · Fixed by #947
Closed

Confusion when using multiple pattern-either inside patterns #828

inkz opened this issue May 25, 2020 · 2 comments · Fixed by #947
Assignees
Labels
bug Something isn't working
Milestone

Comments

@inkz
Copy link
Member

inkz commented May 25, 2020

In my opinion: using patterns and pattern-either within one rule sometimes behave not as it would be predicted according to the docs (https://github.com/returntocorp/semgrep/blob/develop/docs/configuration-files.md#patterns)

as I understand from the docs:
patterns performs a logical AND operation
pattern-either operator performs a logical OR operation

so by doing smth like this (sorry if its messy, tried hard to come up with descriptive example):
https://semgrep.live/9d8

  patterns:
    - pattern-either:
      - pattern: foo('bar',...)
      - pattern: foo('zzz',...)
    - pattern-either:
      - pattern: foo($X,1,...)
      - pattern: foo($X,2,...)

I would expect the logic like this:

(foo('bar',...) OR foo('zzz',...)) AND (foo($X,1,...) OR foo($X,2,...))

so it means that I want to find usage of foo with either 'bar' or 'zzz' as the first argument and 1 or 2 as the second

but for now it seems like logically semgrep treats this rule as:

foo('bar',...) OR foo('zzz',...) OR foo($X,1,...) OR foo($X,2,...)

and highlights code if any of the pattern matches

example link: https://semgrep.live/9d8

@aryx
Copy link
Collaborator

aryx commented May 26, 2020

@ievans is the expert on boolean logic on patterns :) @brendongo might know too.

@ievans
Copy link
Member

ievans commented May 26, 2020

@inkz I agree with you, this looks like a bug to me. @brendongo could investigate. @brendongo I added comments with notes on what examples I would expect to match: https://semgrep.live/Gl2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Development

Successfully merging a pull request may close this issue.

5 participants