github / github/codeql

[False positive] `py/unused-local-variable` on SQLAlchemy model definition classes

オープン
#11,407 コメント 4 件 リアクション 1 件 担当者 0 名 GitHub で見る
acknowledged false-positive not security Python
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

Hi there,

thanks a stack for bringing LGTM to CodeQL. We used your kickstart template PR https://github.com/crate/crate-python/pull/467 for making the transition happen on one of our Python repositories and wanted to report back about a potential false positive, after mitigating all other admonitions on our end before.

With kind regards,
Andreas.

**Description of the false positive**

`py/unused-local-variable` is raised on SQLAlchemy model definition classes, which are only defined, but not used.

**Code samples or links to source code**

```python
class DummyTable(Base):
__tablename__ = "t"
pk = sa.Column(sa.String, primary_key=True)
tags = sa.Column(ObjectArray)

Base.metadata.create_all()
```

- There is a corresponding PR, including the offending code, in a repro repository at https://github.com/crate-workbench/codeql-evaluations/pull/4.

**URL to the alert on GitHub code scanning (optional)**

- https://github.com/crate/crate-python/security/code-scanning/44
- https://github.com/crate-workbench/codeql-evaluations/security/code-scanning/2

**Thoughts**

I wonder if anything can be done about it, other than manually dismissing corresponding admonitions?

As far as we understand, CodeQL does not feature inline suppression comments/instructions, like what LGTM did with `lgtm[py/import-and-import-from]`, right? (https://github.com/crate/crate-python/commit/4397cc2e7)

Do you have any other suggestions on this matter?

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。