github / github/codeql

Python: Mixing implicit/explicit returns false positive

Ouverte
#18,521 2 commentaires 1 réaction 0 personnes assignées Voir sur GitHub
false-positive
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

**Description of the false positive**

I am seeing an ` Mixing implicit and explicit returns may indicate an error as implicit returns always return None.` alert where the code actually always has a return.
In my interpretation of the alert it seems that the issue is that CodeQL isn't considering the `case _:` in a match to be acting as a default case so it believes that there should be a `return None` outside of the `match`.

**Code samples or links to source code**

I had to slightly redact the code but I believe that this is the same:
(ironically this is in a piece of code that processes codeql alerts, don't get confused 😄)

```python
def codeql_severity_conversion(self, security_severity, severity):
match (security_severity, severity):
case ("critical", _) | ("high", _) | ("low", _):
return security_severity
case ("medium", _):
return "moderate"
case (None, "error"):
return "high"
case (None, "warning"):
return "moderate"
case (None, "note") | (None, "none"):
return "low"
case _:
return "high"
```

**URL to the alert on GitHub code scanning (optional)**

I'd rather not share the link outside the enterprise. The link to the rule in the alert is https://github.com/github/codeql/blob/d42788844f7ec0a6b9832140313cc2318e513987/python/ql/src/Functions/ConsistentReturns.ql

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Start by reading python/ql/src/Functions/ConsistentReturns.ql and compare its return-flow handling with the supplied Python match example. Reproduce the alert if possible; done means a function with a case _ default return is no longer reported as mixing implicit and explicit returns.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
python
Domaine
security
Type d'issue
Bug
Difficulté
3/5
Temps estimé
1-2 jours
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
38/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.