You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Impressively, the analysis found a statically defined string in the main function which does not have certain keywords in it that the call to format in a separate function output_format has. Unfortunately, the analysis missed the fact that there is a second code path where output_format is called with user-provided strings (that may have those keywords).
Surplus named argument for string format. An argument named 'priority' is provided, but it is not required by format "{id:>18} {username:<8.8} {name:<10.10} {state:<8.8} {ntasks:>6} {runtime_fsd_hyphen}".
This is an easy-enough error to suppress, but I figured I'd file the false positive. Really amazing tool BTW!
Thank you for your report and for your kind words!
We'll have a look at whether this false positive can be eliminated from our query. I think it should boil down to whether we can correctly identify that it is possible for there to be an "unknown" format string passed to the format method.
In the meantime, you can suppress it, as you've already noted.
Thank you for using LGTM!
tausbn
added a commit
to tausbn/codeql
that referenced
this issue
Feb 12, 2021
Reported in github#2650
I found this during a bit of spring cleaning in my working
directory. As this doesn't have any immediate security implications, I
don't know when we'll get round to fixing it, but it can't hurt to
have the test case checked in.
Description of the false positive
Impressively, the analysis found a statically defined string in the
main
function which does not have certain keywords in it that the call toformat
in a separate functionoutput_format
has. Unfortunately, the analysis missed the fact that there is a second code path whereoutput_format
is called with user-provided strings (that may have those keywords).Seemingly relevant bits:
Output from LGTM:
This is an easy-enough error to suppress, but I figured I'd file the false positive. Really amazing tool BTW!
URL to the alert on the project page on LGTM.com
https://lgtm.com/projects/g/flux-framework/flux-core/snapshot/ee30ed85d95632cea4f1bb1a1a4deb1046fd95b5/files/src/cmd/flux-jobs.py#xc23648d36039a520:1
The text was updated successfully, but these errors were encountered: