Metavariable patterns

[kiwiz]

Is your feature request related to a problem? Please describe.

Let's say I'm looking for calls to the following functions:

• sqlx.Get($_X, $_Y, $QUERY, ...)
• $OBJ.Get($_X, $QUERY, ...)

I'd like to be able to match cases where $QUERY is an expression like:

• $X + $Y
• fmt.Sprintf("...", $X)
• etc

Describe the solution you'd like

It'd be nice to be able to define patterns that $QUERY must match in a concise way.

Describe alternatives you've considered

It's possible to work around this by just enumerating all the cases - for the example above, we'd have:

• sqlx.Get($_X, $_Y, $X + $Y, ...)
• sqlx.Get($_X, $_Y, fmt.Sprintf("...", $X), ...)
• $OBJ.Get($_X, $X + $Y, ...)
• $OBJ.Get($_X, fmt.Sprintf("...", $X), ...), ...)

... but this gets unwieldy as more clauses are introduced.

[ievans]

@kiwiz thanks for this feedback. We have a different solution in mind for cases like this that I wonder if you found in the experiments section of the docs: taint mode. https://semgrep.dev/docs/experiments/overview/#taint-tracking. Would be curious for your feedback!

[kiwiz]

@ievans Oh, good point! I've played around with taint tracing, but I haven't used it for any real rules yet. After some consideration, I think that isn't quite what I'm looking for (in this specific case) as I don't have any specific sources in mind - I just want to discourage this pattern.

[aryx]

metavariable-pattern is now supported in semgrep-core! It just remains a little bit of work
to make it available in the semgrep python wrapper.