search

github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
https://codeql.github.com
MIT License
7.51k stars 1.49k forks source link

LGTM.com - false positive #4024

Open WhyNotHugo opened 4 years ago

WhyNotHugo commented 4 years ago

Description of the false positive

This function is calling super. It's using python2-compatible syntax in a python3-only project, but the call to init still works.

URL to the alert on the project page on LGTM.com

https://lgtm.com/projects/g/mirumee/django-payments/rev/pr-cf8a1ae2dfa932f0fcc02f031698bbd57324c063

Relevant https://github.com/mirumee/django-payments/pull/223#issuecomment-670149501

Can't do the inline instructions:

  1. Open the project on LGTM.com. For example, https://lgtm.com/projects/g/pallets/click/.
  2. Switch to the Alerts tab. For example, https://lgtm.com/projects/g/pallets/click/alerts/.
  3. Scroll to the alert that you would like to report. <-- doesn't show up here.
  4. Click on the right most icon View this alert within the complete file.
  5. A new browser tab opens. Copy and paste the page URL here. For example, https://lgtm.com/projects/g/pallets/click/snapshot/719fb7d8322b0767cdd1e5903ba3eb3233ba8dd5/files/click/_winconsole.py#xa08d213ab3289f87:1.

I've no idea how to change the branch on the UI, there's on clean way of doing it.

tausbn commented 4 years ago

Thank you for your report. I agree that this looks like a false positive.

We're currently very busy reworking large parts of the Python QL libraries, so we won't be addressing this FP until later this year. In the meantime, if you find the alert bothersome, you can disable it by suppressing the alert, either locally or for the entire project

WhyNotHugo commented 4 years ago

Makes sense. Sounds like it'll be addressed one way or another then. Cheers!