Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LGTM.com - false positive: unused argument to format #2650

Open
SteVwonder opened this issue Jan 18, 2020 · 1 comment
Open

LGTM.com - false positive: unused argument to format #2650

SteVwonder opened this issue Jan 18, 2020 · 1 comment

Comments

@SteVwonder
Copy link

Description of the false positive

Impressively, the analysis found a statically defined string in the main function which does not have certain keywords in it that the call to format in a separate function output_format has. Unfortunately, the analysis missed the fact that there is a second code path where output_format is called with user-provided strings (that may have those keywords).

Seemingly relevant bits:

def output_format(fmt, jobs):
    for job in jobs:
        s = fmt.format(
            id=job["id"],
            userid=job["userid"],
            username=job_username(job),
            priority=job["priority"],
            state=statetostr(job, False),
            state_single=statetostr(job, True),
            name=job["name"],
            ntasks=job["ntasks"],
            t_submit=job["t_submit"],
            t_depend=job["t_depend"],
            t_sched=job["t_sched"],
            t_run=job["t_run"],
            t_cleanup=job["t_cleanup"],
            t_inactive=job["t_inactive"],
            runtime=runtime(job, False),
            runtime_fsd=runtime_fsd(job, False),
            runtime_fsd_hyphen=runtime_fsd(job, True),
            runtime_hms=runtime_hms(job),
        )
        print(s)

def main():
    args = parse_args()
    jobs = fetch_jobs(args)

    if args.format:
        output_format(args.format, jobs)
    else:
        fmt = (
            "{id:>18} {username:<8.8} {name:<10.10} {state:<8.8} "
            "{ntasks:>6} {runtime_fsd_hyphen}"
        )
        if not args.suppress_header:
            s = fmt.format(
                id="JOBID",
                username="USER",
                name="NAME",
                state="STATE",
                ntasks="NTASKS",
                runtime_fsd_hyphen="RUNTIME",
            )
            print(s)
        output_format(fmt, jobs)

Output from LGTM:

Surplus named argument for string format. An argument named 'priority' is provided, but it is not required by format "{id:>18} {username:<8.8} {name:<10.10} {state:<8.8} {ntasks:>6} {runtime_fsd_hyphen}".

This is an easy-enough error to suppress, but I figured I'd file the false positive. Really amazing tool BTW!

URL to the alert on the project page on LGTM.com

https://lgtm.com/projects/g/flux-framework/flux-core/snapshot/ee30ed85d95632cea4f1bb1a1a4deb1046fd95b5/files/src/cmd/flux-jobs.py#xc23648d36039a520:1

@tausbn
Copy link
Contributor

tausbn commented Jan 21, 2020

Thank you for your report and for your kind words!

We'll have a look at whether this false positive can be eliminated from our query. I think it should boil down to whether we can correctly identify that it is possible for there to be an "unknown" format string passed to the format method.

In the meantime, you can suppress it, as you've already noted.

Thank you for using LGTM!

tausbn added a commit to tausbn/codeql that referenced this issue Feb 12, 2021
Reported in github#2650

I found this during a bit of spring cleaning in my working
directory. As this doesn't have any immediate security implications, I
don't know when we'll get round to fixing it, but it can't hurt to
have the test case checked in.
@tausbn tausbn removed their assignment Feb 16, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants