github / github/codeql

[False positive] `py/call-to-non-callable` on _decorated_ `__call__` magic methods

Open
#11,408 1 comment 1 reaction 0 assignees View on GitHub
acknowledged false-positive not security Python
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

Hi there,

thanks a stack for bringing LGTM to CodeQL. We used your kickstart template PR https://github.com/crate/crash/pull/373 for making the transition happen on one of our Python repositories and wanted to report back about a potential false positive, after mitigating all other admonitions on our end before.

With kind regards,
Andreas.

**Description of the false positive**

`py/call-to-non-callable` is raised on _decorated_ `__call__` magic methods.

**Code samples or links to source code**

```python
class FooBarCommand(Command):

@noargs_command
def __call__(self, cmd, *args, **kwargs):
return f"{cmd}: foobar"
```

- There is a corresponding PR, including the offending code, in a repro repository at https://github.com/crate-workbench/codeql-evaluations/pull/3.

**URL to the alert on GitHub code scanning (optional)**

- https://github.com/crate/crash/security/code-scanning/5
- https://github.com/crate-workbench/codeql-evaluations/security/code-scanning/1

**Thoughts**

I wonder if anything can be done about it, other than manually dismissing corresponding admonitions? Do you have any other suggestions on this matter?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.