In file: structured.py, method: interpolate, a logical expression uses the identity operator. A new object is created inside the identity check operation and then used for matching identity. Since this is a distinct, new object, it will not have identity and will match with anything else. As a result, the identity check will have a logical short circuit and the program may have unintended behavior.
The following binary operation
profiles is not []
compares a newly created object with the identity operator which will always evaluate to True.
I suggested that the logical operation should be reviewed for correctness.
Sponsorship and Support:
This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF): Project Alpha-Omega. Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.
The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.
In file: structured.py, method:
interpolate, a logical expression uses the identity operator. A new object is created inside the identity check operation and then used for matching identity. Since this is a distinct, new object, it will not have identity and will match with anything else. As a result, the identity check will have a logical short circuit and the program may have unintended behavior.The following binary operation
compares a newly created object with the identity operator which will always evaluate to True.
I suggested that the logical operation should be reviewed for correctness.
Sponsorship and Support:
This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF): Project Alpha-Omega. Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.
The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.