Semgrep: the end line is part of the match

The match can cover more than one line

The result’s start and end locate the pattern in the file that was scanned. When they differ, the match is the whole span. A note that quotes only the start line has not shown the lines the rule used.

The end line is still in the same file. It is not a second finding and not a second path.

Quote the span you mean

If you paste code into the ticket, paste from the start line through the end line, and say so. Pasting a neighboring function because it looks related adds code the rule did not match.

When start and end are the same number, say the match is that single line. Do not invent an end line to make the finding look larger.

What to file

File the rule id, the path, the start line, and the end line. If the paste dropped the end, write “end line not in the paste” and do not review the finding as a one-line match you have confirmed.

Worked case: a call that finishes three lines later

A lab finding has start line 12 and end line 15 in src/labclient.py. Line 12 is the name of a helper. The arguments the rule matched are on lines 13 through 15. A draft quotes only line 12 and says the helper’s name is the whole defect.

The note quotes 12 through 15. The name on line 12 is the start of the span, not the entire match. The review uses the four lines. A different function below line 15 is not added.

rule: lab-client-timeout
path: src/labclient.py
start: 12
end: 15
write: the match is lines 12-15
not: line 12 alone, and not the next function