search

github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
https://codeql.github.com
MIT License
7.51k stars 1.49k forks source link

[Python] LGTM.com - false positive #5777

Open ptmerz opened 3 years ago

ptmerz commented 3 years ago

Description of the false positive

This is a test comparing two objects. The two objects are created to have identical content, which is asserted. Then, one object is changed, and it is asserted that they are different now. LGTM thinks that they should still be equivalent. The test passes, which proves LGTM wrong :)

URL to the alert on the project page on LGTM.com

https://lgtm.com/projects/g/shirtsgroup/physical_validation/snapshot/1ab30ac2bfa1a86a40ee461d23624b92594c9307/files/physical_validation/tests/test_data_simulation_data.py?sort=name&dir=ASC&mode=heatmap#xd52d8129570232b3:1

RasmusWL commented 3 years ago

Indeed, this is a false positive :joy: Thank you for reporting it!

Our current focus is on improving our security analysis. Because your report does not relate to a security query, we will put this on our backlog and prioritize it if we get enough reports of the same underlying issue in other projects. If you think that your report is related to our security analysis, please clarify that in a comment. Either way, we'll let you know here as soon as it's fixed!

Just FYI, both GitHub Code Scanning and LGTM.com have facilities for suppressing individual alerts or disabling a query.

ptmerz commented 3 years ago

Sounds good, thanks!