github / github/codeql

False positive: "File is not always closed" (Python)

未关闭
#11,533 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
false-positive
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

**Description of the false positive**

There is an edge case in `py/file-not-closed` for statements of the form `open(fn, "w").close()`, discovered in sopel-irc/sopel#2381

Unless I have missed something nuanced, there is no way for this Python statement to leave a dangling file object. Either `open()` succeeds and then `close()` is immediately called, or it does not succeed and there is no file object that needs to be closed.

**Code samples or links to source code**

https://github.com/sopel-irc/sopel/blob/97f9491c199850722b9c7f8a43ac4d77d536d8fe/sopel/config/types.py#L744-L744

**URL to the alert on GitHub code scanning (optional)**

https://github.com/sopel-irc/sopel/security/code-scanning/107

**CodeQL comments**

* I was hoping that dismissing the issue as a false positive when reviewing the security concerns associated with the automated PR would file this issue automatically for me. It's a bit of a nuisance to offer downstream users a comment field for false positives that (apparently?) does not send feedback upstream.
* I am not very familiar with LGTM/CodeQL but did not find any information in my scan of the documentation that indicated whether it was possible to explicitly opt out of a security alert in a particular part of a Python program, or whether an alert will be suppressed in the future once dismissed if the associated code has not changed. This seems like a missing stair in user documentation.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。