github / github/codeql

False positive: "File is not always closed" (Python)

Aperta
#11,533 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
false-positive
Lingua principale
CodeQL
Stelle
10.1k
Fork
2.1k
Merge medio
2g 15h
PR unite (30g)
141

Descrizione

**Description of the false positive**

There is an edge case in `py/file-not-closed` for statements of the form `open(fn, "w").close()`, discovered in sopel-irc/sopel#2381

Unless I have missed something nuanced, there is no way for this Python statement to leave a dangling file object. Either `open()` succeeds and then `close()` is immediately called, or it does not succeed and there is no file object that needs to be closed.

**Code samples or links to source code**

https://github.com/sopel-irc/sopel/blob/97f9491c199850722b9c7f8a43ac4d77d536d8fe/sopel/config/types.py#L744-L744

**URL to the alert on GitHub code scanning (optional)**

https://github.com/sopel-irc/sopel/security/code-scanning/107

**CodeQL comments**

* I was hoping that dismissing the issue as a false positive when reviewing the security concerns associated with the automated PR would file this issue automatically for me. It's a bit of a nuisance to offer downstream users a comment field for false positives that (apparently?) does not send feedback upstream.
* I am not very familiar with LGTM/CodeQL but did not find any information in my scan of the documentation that indicated whether it was possible to explicitly opt out of a security alert in a particular part of a Python program, or whether an alert will be suppressed in the future once dismissed if the associated code has not changed. This seems like a missing stair in user documentation.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.