github / github/codeql

False positive: "File is not always closed" (Python)

Đang mở
#11,533 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
false-positive
Ngôn ngữ chính
CodeQL
Star
10.1k
Fork
2.1k
Merge trung bình
2 ngày 15 giờ
Pull request đã merge (30 ngày)
141

Mô tả

**Description of the false positive**

There is an edge case in `py/file-not-closed` for statements of the form `open(fn, "w").close()`, discovered in sopel-irc/sopel#2381

Unless I have missed something nuanced, there is no way for this Python statement to leave a dangling file object. Either `open()` succeeds and then `close()` is immediately called, or it does not succeed and there is no file object that needs to be closed.

**Code samples or links to source code**

https://github.com/sopel-irc/sopel/blob/97f9491c199850722b9c7f8a43ac4d77d536d8fe/sopel/config/types.py#L744-L744

**URL to the alert on GitHub code scanning (optional)**

https://github.com/sopel-irc/sopel/security/code-scanning/107

**CodeQL comments**

* I was hoping that dismissing the issue as a false positive when reviewing the security concerns associated with the automated PR would file this issue automatically for me. It's a bit of a nuisance to offer downstream users a comment field for false positives that (apparently?) does not send feedback upstream.
* I am not very familiar with LGTM/CodeQL but did not find any information in my scan of the documentation that indicated whether it was possible to explicitly opt out of a security alert in a particular part of a Python program, or whether an alert will be suppressed in the future once dismissed if the associated code has not changed. This seems like a missing stair in user documentation.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.