Python: False positive: Tuple Destructuring
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
**Description of the false positive**
CodeQL incorrectly identifies dataflow occurring from a constant value when a tuple is being destructured.
**Code samples or links to source code**

Here's it's very clear that `status` will always be `200` on this data flow path, but CodeQL incorrectly believes there is dataflow from the `res.json()` to the `status` variable.
https://github.com/Chainguard-Wolfi-Bites-Back/istio__istio/security/code-scanning/5
Contributor guide
Research direction
Start with the linked code-scanning result and the tuple-destructuring scenario described in the issue. Investigate how CodeQL models dataflow for the Python example, then verify that a constant status value is not reported as receiving dataflow from res.json().
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100