codeql icon indicating copy to clipboard operation
codeql copied to clipboard

LGTM.com - false positive - unused variable with vue setup script

Open kelsos opened this issue 2 years ago • 2 comments

Description of the false positive

When using the new in vue sfcs the top-level functions/variables are automatically exposed to the template.

Since they are not used inside the <script> lgtm.com marks them as unused, despite them being referenced from the template.

<template>
  <button @click="log">{{ msg }}</button>
</template>

<script setup>
// variable
const msg = 'Hello!'

// functions
const log = () => {
  console.log(msg)
}
</script>

URL to the alert on the project page on LGTM.com https://lgtm.com/projects/g/rotki/rotki/snapshot/cc87af463bd9976f8ee7d090c770e7c79de61c7d/files/frontend/app/src/components/settings/general/QueryPeriodSettings.vue?sort=name&dir=ASC&mode=heatmap#x87a8976eef9f9886:1

kelsos avatar Jul 27 '22 10:07 kelsos

Indeed, this looks like a false positive. Thank you for reporting it!

Our current focus is on improving our security analysis. Because your report does not relate to a security query, we will put this on our backlog and prioritize it if we get enough reports of the same underlying issue in other projects. If you think that your report is related to our security analysis, please clarify that in a comment. Either way, we'll let you know here as soon as it's fixed!

As you might know, all of our queries are open source. If you do have an idea for a code change, we encourage you to open a pull request. GitHub Code Scanning and lgtm.com have facilities for suppressing individual alerts or disabling a query.

alexet avatar Jul 28 '22 18:07 alexet

Thanks, @alexet no it is not security related. It's ok no worries.

kelsos avatar Jul 28 '22 18:07 kelsos