github / github/codeql

Rust: False positive for unused variable names

Ouverte
#22,342 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub
false-positive
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

**Description of the false positive**

CodeQL seems to produce false positives for Rust variables in format strings.

**Code samples or links to source code**

On 2026-08-13, the folllowing Rust snippet got [flagged](https://github.com/alltheplaces/osm-diffs/security/code-scanning/30) by CodeQL on https://github.com/alltheplaces/osm-diffs/pull/660. CodeQL posted a notice, claiming `Variable 'name' is not used`. However, the variable _does_ get used in this snippet, via a `format!` macro. We also check for unused variables with clippy, which does not flag an unused variable for this code. So, this looks like a false positive from CodeQL.

```rust
let producers: Vec<_> = sources
.into_iter()
.map(|(name, reader)| {
let tx = tx.clone();
s.spawn(move || -> Result<()> {
for record in reader.iter()? {
let bytes = record?;
let fti = FeatureToIndex::decode(bytes.as_slice()).with_context(|| {
format!("failed to decode a FeatureToIndex record from {name}")
})?;
tx.send(fti)?;
progress_bar.inc(1);
}
Ok(())
})
})
.collect();
```

**URL to the alert on GitHub code scanning (optional)**

https://github.com/alltheplaces/osm-diffs/security/code-scanning/30

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Start with the linked code-scanning alert and the Rust snippet, then trace the CodeQL Rust unused-variable query's handling of format! interpolation. Done means the query no longer reports `name` as unused while still detecting genuinely unused variables.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
rust
Domaine
security
Type d'issue
Bug
Difficulté
4/5
Temps estimé
3-5 jours
Activité
Calme
Clarté
À clarifier
Accessibilité débutants
38/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.