codeql
codeql copied to clipboard
Python: False positive: Tuple Destructuring
Description of the false positive
CodeQL incorrectly identifies dataflow occurring from a constant value when a tuple is being destructured.
Code samples or links to source code
Here's it's very clear that status will always be 200 on this data flow path, but CodeQL incorrectly believes there is dataflow from the res.json() to the status variable.
https://github.com/Chainguard-Wolfi-Bites-Back/istio__istio/security/code-scanning/5
Thank you for this false positive report. Resolving this issue is not a current product priority, but we acknowledge the report and will track it internally for future consideration, or if we observe repeated instances of the same problem.
This seems to have the same cause as https://github.com/github/codeql/issues/16976