CodeQL: False positive for uninitialized variable (via import) in Python

[pyrito]

Description of the false positive

connectorx won't be called unless the boolean is true, which only happens when the try finishes successfully.

Code samples or links to source code

https://github.com/modin-project/modin/pull/5222/files#file-modin-core-storage_formats-pandas-parsers-py-L807

[pyrito]

cc: @aeisenberg wondering if you know how we can side step this issue?

[pyrito]

For further context:

[pyrito]

Link to code: https://github.com/modin-project/modin/blob/bf8958362ecd02efd04ccb67b58fd1e44126979f/modin/core/storage_formats/pandas/parsers.py#L774-L818

[aeisenberg]

This is another case of codeql failing to follow some data flow. To be honest, it took me a few seconds to make sure it was correct. Even though your code is not incorrect, perhaps a simplification may help (and this would also appease codeql).

Instead of defining enable_cx before the try block, and setting it again inside the if block, you can try adding this line after the try and if blocks:

enable_cx = 'cx' in locals()

Alternatively, you can just choose to ignore the error in the code.

[pyrito]

@aeisenberg thanks for the suggestion! What's the right way to ignore the error in the code? I was trying to find some documentation on this but couldn't.

[aeisenberg]

You can dismiss alerts either from the security tab or directly in the code. See the documentation here: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository#dismissing--alerts

[pyrito]

Thanks @aeisenberg ! P.s. your suggestion using locals() doesn't seem to do the trick either: https://github.com/modin-project/modin/pull/5222/checks?check_run_id=9538451822

[aeisenberg]

I can't think of another way of avoiding this in the code. I would recommend that you dismiss the alert as a false positive.

Because this is not a security-related false positive, our team will not prioritize fixing this query.