github / github/codeql

False positive: "File is not always closed" (Python)

Abierto
#11,533 0 comentarios 0 reacciones 0 asignados Ver en GitHub
false-positive
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the false positive**

There is an edge case in `py/file-not-closed` for statements of the form `open(fn, "w").close()`, discovered in sopel-irc/sopel#2381

Unless I have missed something nuanced, there is no way for this Python statement to leave a dangling file object. Either `open()` succeeds and then `close()` is immediately called, or it does not succeed and there is no file object that needs to be closed.

**Code samples or links to source code**

https://github.com/sopel-irc/sopel/blob/97f9491c199850722b9c7f8a43ac4d77d536d8fe/sopel/config/types.py#L744-L744

**URL to the alert on GitHub code scanning (optional)**

https://github.com/sopel-irc/sopel/security/code-scanning/107

**CodeQL comments**

* I was hoping that dismissing the issue as a false positive when reviewing the security concerns associated with the automated PR would file this issue automatically for me. It's a bit of a nuisance to offer downstream users a comment field for false positives that (apparently?) does not send feedback upstream.
* I am not very familiar with LGTM/CodeQL but did not find any information in my scan of the documentation that indicated whether it was possible to explicitly opt out of a security alert in a particular part of a Python program, or whether an alert will be suppressed in the future once dismissed if the associated code has not changed. This seems like a missing stair in user documentation.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.