search

github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
https://codeql.github.com
MIT License
7.56k stars 1.51k forks source link

LGTM.com - false positive with torch.nn.Sequential #5789

Open ekolve opened 3 years ago

ekolve commented 3 years ago

An alert was triggered that a torch.nn.Sequential model was not callable.

The model is intended to be a callable - https://pytorch.org/tutorials/beginner/pytorch_with_examples.html#pytorch-nn.

Alert: https://lgtm.com/projects/g/allenai/allenact/snapshot/5a2b317d0532bd2999b6bfa101522ff45c7ea8c9/files/allenact/embodiedai/mapping/mapping_models/active_neural_slam.py?sort=name&dir=ASC&mode=list#x3719db148fcfd007:1

RasmusWL commented 3 years ago

I agree that this is a false positive, since the base class torch.nn.modules.Module has __call__ defined. Thank you for reporting it!

Our current focus is on improving our security analysis. Because your report does not relate to a security query, we will put this on our backlog and prioritize it if we get enough reports of the same underlying issue in other projects. If you think that your report is related to our security analysis, please clarify that in a comment. Either way, we'll let you know here as soon as it's fixed!

Just FYI, all of our queries are open source, so if you do have an idea for a code change, we encourage you to open a pull request. I also want to point out that both GitHub Code Scanning and LGTM.com have facilities for suppressing individual alerts or disabling a query.