Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions docs/writing-rules/rule-syntax.md
Original file line number Diff line number Diff line change
Expand Up @@ -856,6 +856,25 @@ db_query("SELECT * FROM ...")
db_query("SELECT * FROM ...", verify=True, env="prod")
```

Alternatively, `pattern-not` accepts a `patterns` or `pattern-either` property and negates everything inside the property.

```yaml
rules:
- id: unverified-db-query
patterns:
- pattern: db_query(...)
- pattern-not:
pattern-either:
- pattern: db_query(..., verify=True, ...)
- pattern-inside: |
with ensure_verified(db_query):
db_query(...)
message: Found unverified db query
severity: ERROR
languages:
- python
```

### `pattern-inside`

The `pattern-inside` operator keeps matched findings that reside within its expression. This is useful for finding code inside other pieces of code like functions or if blocks.
Expand Down