Python: False positive: Tuple Destructuring
- Linguagem predominante
- CodeQL
- Estrelas
- 10.1k
- Forks
- 2.1k
- Merge médio
- 2d 15h
- PRs com merge (30d)
- 141
Descrição
**Description of the false positive**
CodeQL incorrectly identifies dataflow occurring from a constant value when a tuple is being destructured.
**Code samples or links to source code**

Here's it's very clear that `status` will always be `200` on this data flow path, but CodeQL incorrectly believes there is dataflow from the `res.json()` to the `status` variable.
https://github.com/Chainguard-Wolfi-Bites-Back/istio__istio/security/code-scanning/5
Guia de contribuição
Direção de pesquisa
Start with the linked code-scanning result and the tuple-destructuring scenario described in the issue. Investigate how CodeQL models dataflow for the Python example, then verify that a constant status value is not reported as receiving dataflow from res.json().
Escrita pelo modelo de indexação a partir do texto da issue.
Avaliação
- Stack de tecnologia
- python
- Domínio
- security
- Tipo de issue
- Bug
- Dificuldade
- 4/5
- Tempo estimado
- 3-5 dias
- Status de atividade
- Pouca atividade
- Clareza
- Precisa de esclarecimento
- Facilidade para iniciantes
- 42/100