github / github/codeql

False positive: "File is not always closed" (Python)

オープン
#11,533 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
false-positive
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

**Description of the false positive**

There is an edge case in `py/file-not-closed` for statements of the form `open(fn, "w").close()`, discovered in sopel-irc/sopel#2381

Unless I have missed something nuanced, there is no way for this Python statement to leave a dangling file object. Either `open()` succeeds and then `close()` is immediately called, or it does not succeed and there is no file object that needs to be closed.

**Code samples or links to source code**

https://github.com/sopel-irc/sopel/blob/97f9491c199850722b9c7f8a43ac4d77d536d8fe/sopel/config/types.py#L744-L744

**URL to the alert on GitHub code scanning (optional)**

https://github.com/sopel-irc/sopel/security/code-scanning/107

**CodeQL comments**

* I was hoping that dismissing the issue as a false positive when reviewing the security concerns associated with the automated PR would file this issue automatically for me. It's a bit of a nuisance to offer downstream users a comment field for false positives that (apparently?) does not send feedback upstream.
* I am not very familiar with LGTM/CodeQL but did not find any information in my scan of the documentation that indicated whether it was possible to explicitly opt out of a security alert in a particular part of a Python program, or whether an alert will be suppressed in the future once dismissed if the associated code has not changed. This seems like a missing stair in user documentation.

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。