Python: Mixing implicit/explicit returns false positive
- Lingua principale
- CodeQL
- Stelle
- 10.1k
- Fork
- 2.1k
- Merge medio
- 2g 15h
- PR unite (30g)
- 141
Descrizione
**Description of the false positive**
I am seeing an ` Mixing implicit and explicit returns may indicate an error as implicit returns always return None.` alert where the code actually always has a return.
In my interpretation of the alert it seems that the issue is that CodeQL isn't considering the `case _:` in a match to be acting as a default case so it believes that there should be a `return None` outside of the `match`.
**Code samples or links to source code**
I had to slightly redact the code but I believe that this is the same:
(ironically this is in a piece of code that processes codeql alerts, don't get confused 😄)
```python
def codeql_severity_conversion(self, security_severity, severity):
match (security_severity, severity):
case ("critical", _) | ("high", _) | ("low", _):
return security_severity
case ("medium", _):
return "moderate"
case (None, "error"):
return "high"
case (None, "warning"):
return "moderate"
case (None, "note") | (None, "none"):
return "low"
case _:
return "high"
```
**URL to the alert on GitHub code scanning (optional)**
I'd rather not share the link outside the enterprise. The link to the rule in the alert is https://github.com/github/codeql/blob/d42788844f7ec0a6b9832140313cc2318e513987/python/ql/src/Functions/ConsistentReturns.ql
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Start by reading python/ql/src/Functions/ConsistentReturns.ql and compare its return-flow handling with the supplied Python match example. Reproduce the alert if possible; done means a function with a case _ default return is no longer reported as mixing implicit and explicit returns.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- python
- Ambito
- security
- Tipo di issue
- Bug
- Difficoltà
- 3/5
- Tempo stimato
- 1-2 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 38/100