Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt

Use this file to discover all available pages before exploring further.

One common issue when writing custom rules involves the unsuccessful exclusion of cases using pattern-not. If you are trying to exclude a specific case where a pattern is unacceptable unless it is accompanied by another pattern, try pattern-not-inside instead of pattern-not.

​
Background

In Semgrep, a pattern that’s inside another pattern can mean one of two things:
  • The pattern is wholly within an outer pattern
  • The pattern is at the same level as another pattern, but includes less code
In other words, using pattern-not in your rule means that Semgrep expects the matches to be the same “size” (same amount of code), and does not match if that’s not the case.

​
Example

The example rule find-unverified-transactions is a good example: make_transaction($T) is acceptable only if verify_transaction($T) is also present. To successfully match the target code, the rule uses pattern and pattern-not:
But this rule is redundant. Both pattern clauses contain: 
public $RETURN $METHOD(...){
  ...
}
However, if you refactor the rule by pulling the container out and using pattern-inside, the rule doesn’t work — try it out if you like! 
rules:
  - id: find-unverified-transactions-inside
    patterns:
      - pattern-inside: |
          $RETURN $METHOD(...) {
            ...
          }
      - pattern: |
          ...
          make_transaction($T);
          ...
      - pattern-not: |
          ...
          verify_transaction($T);
          ...
          make_transaction($T);
          ...
With an understanding of how pattern-not operates, you can see that this rule fails because the matches are not the same size. The pattern-not match is at the same level, but it is “larger” (contains more code). If you switch to pattern-not-inside: 
- pattern-not-inside: |
    ...
    verify_transaction($T);
    ...
    make_transaction($T);
    ...
The rule successfully matches the example code.

​
Further information

See this video for more information about the difference between pattern-not and pattern-not-inside.