r2c-best-practices

python.lang.correctness.common-mistakes.default-mutable-dict.default-mutable-dict

returntocorp

Function $F mutates default dict $D. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the instance used by all future function calls. This can cause unexpected results, or lead to security vulnerabilities whereby one function consumer can view or modify the data of another function consumer. Instead, use a default argument (like None) to indicate that no argument was provided and instantiate a new dictionary at that time. For example: `if $D is None: $D = {}`.

python.lang.correctness.common-mistakes.default-mutable-list.default-mutable-list

returntocorp

Function $F mutates default list $D. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the instance used by all future function calls. This can cause unexpected results, or lead to security vulnerabilities whereby one function consumer can view or modify the data of another function consumer. Instead, use a default argument (like None) to indicate that no argument was provided and instantiate a new list at that time. For example: `if $D is None: $D = []`.

python.lang.correctness.dict-modify-iterating.dict-del-while-iterate

returntocorp

It appears that `$DICT[$KEY]` is a dict with items being deleted while in a for loop. This is usually a bad idea and will likely lead to a RuntimeError: dictionary changed size during iteration

python.lang.correctness.useless-eqeq.useless-eqeq

returntocorp

This expression is always True: `$X == $X` or `$X != $X`. If testing for floating point NaN, use `math.isnan($X)`, or `cmath.isnan($X)` if the number is complex.

python.lang.correctness.tempfile.flush.tempfile-without-flush

returntocorp

Using '$F.name' without '.flush()' or '.close()' may cause an error because the file may not exist when '$F.name' is used. Use '.flush()' or close the file before using '$F.name'.

python.lang.maintainability.useless-ifelse.useless-if-conditional

returntocorp

if block checks for the same condition on both branches (`$X`)

python.lang.maintainability.useless-literal.useless-literal-dict

returntocorp

key `$X` is uselessly assigned twice

go.lang.correctness.useless-eqeq.hardcoded-eq-true-or-false

returntocorp

Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on which expression is in the code.

python.lang.correctness.common-mistakes.is-comparison-string.string-is-comparison

returntocorp

Found string comparison using 'is' operator. The 'is' operator is for reference equality, not value equality, and therefore should not be used to compare strings. For more information, see https://github.com/satwikkansal/wtfpython#-how-not-to-use-is-operator"

python.lang.correctness.list-modify-iterating.list-modify-while-iterate

returntocorp

It appears that `$LIST` is a list that is being modified while in a for loop. This will likely cause a runtime error or an infinite loop.

python.lang.correctness.useless-comparison.no-strings-as-booleans

returntocorp

Using strings as booleans in Python has unexpected results. `"one" and "two"` will return "two". `"one" or "two"` will return "one". In Python, strings are truthy, and strings with a non-zero length evaluate to True.

go.lang.maintainability.useless-ifelse.useless-if-body

returntocorp

Detected identical statements in the if body and the else body of an if-statement. This will lead to the same code being executed no matter what the if-expression evaluates to. Instead, remove the if statement.

go.lang.maintainability.useless-ifelse.useless-if-conditional

returntocorp

Detected an if block that checks for the same condition on both branches (`$X`). The second condition check is useless as it is the same as the first, and therefore can be removed from the code,

java.lang.correctness.eqeq.eqeq

returntocorp

`$X == $X` or `$X != $X` is always true. (Unless the value compared is a float or double). To test if `$X` is not-a-number, use `Double.isNaN($X)`.

python.lang.correctness.common-mistakes.is-not-is-not.is-not-is-not

returntocorp

In Python 'X is not ...' is different from 'X is (not ...)'. In the latter the 'not' converts the '...' directly to boolean.

java.lang.correctness.no-string-eqeq.no-string-eqeq

returntocorp

Strings should not be compared with '=='. This is a reference comparison operator. Use '.equals()' instead.

python.lang.correctness.return-in-init.return-in-init

returntocorp

`return` should never appear inside a class __init__ function. This will cause a runtime error.

python.lang.correctness.return-in-init.yield-in-init

returntocorp

`yield` should never appear inside a class __init__ function. This will cause a runtime error.

javascript.lang.correctness.useless-eqeq.eqeq-is-bad

returntocorp

Detected a useless comparison operation `$X == $X` or `$X != $X`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex.

python.lang.correctness.unchecked-returns.unchecked-subprocess-call

returntocorp

This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead

python.lang.correctness.common-mistakes.is-comparison-string.identical-is-comparison

returntocorp

Found identical comparison using is. Ensure this is what you intended.

python.lang.correctness.exceptions.exceptions.raise-not-base-exception

returntocorp

In Python3, a runtime `TypeError` will be thrown if you attempt to raise an object or class which does not inherit from `BaseException`

python.lang.correctness.exit.use-sys-exit

returntocorp

Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.

python.lang.correctness.common-mistakes.string-concat-in-list.string-concat-in-list

returntocorp

Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?

python.requests.best-practice.use-timeout.use-timeout

returntocorp

Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.

python.lang.correctness.tempfile.mktemp.tempfile-insecure

returntocorp

Use tempfile.NamedTemporaryFile instead. From the official Python documentation: THIS FUNCTION IS UNSAFE AND SHOULD NOT BE USED. The file name may refer to a file that did not exist at some point, but by the time you get around to creating it, someone else may have beaten you to the punch.

python.django.correctness.nontext-field-must-set-null-true.nontext-field-must-set-null-true

returntocorp

null=True should be set if blank=True is set on non-text fields.

python.django.correctness.string-field-null-checks.string-field-must-set-null-true

returntocorp

If a text field declares unique=True and blank=True, null=True must also be set to avoid unique constraint violations when saving multiple objects with blank values.

returntocorp

Use JsonResponse instead

returntocorp

Looks like you need to determine the number of records. Django provides the count() method which is more efficient than .len(). See https://docs.djangoproject.com/en/3.0/ref/models/querysets/

returntocorp

Looks like you are only accessing first element of an ordered QuerySet. Use `latest()` or `earliest()` instead. See https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.latest

returntocorp

You are using environment variables inside django app. Use `django-environ` as it a better alternative for deployment.

returntocorp

Class $C inherits from both `$A` and `$B` which both have a method named `$F`; one of these methods will be overwritten.

returntocorp

Values returned by thread pool map must be read in order to raise exceptions. Consider using `for _ in $EXECUTOR.map(...): pass`.

returntocorp

Detected a file object that is redefined and never closed. This could leak file descriptors and unnecessarily consume system resources.

returntocorp

pdb is an interactive debugging tool and you may have forgotten to remove it before committing your code

returntocorp

The file object '$FD' was opened in read mode, but is being written to. This will cause a runtime error.

returntocorp

Accessing request object inside a route handle for HTTP GET command will throw due to missing request body.

returntocorp

flask.jsonify() is a Flask helper method which handles the correct settings for returning JSON from Flask routes

returntocorp

Detected a django model `$MODEL` is not calling super().save() inside of the save method.

returntocorp

Looks like `$R` is a flask function handler that registered to two different routes. This will cause a runtime error

returntocorp

.delete().where(...) results in a no-op in SQLAlchemy unless the command is executed, use .filter(...).delete() instead.

returntocorp

Use `click.secho($X)` instead. It combines click.echo() and click.style().

returntocorp

The host argument to assertRedirects is removed in Django 2.0.

returntocorp

The assignment_tag helper is removed in Django 2.0.

returntocorp

django.db.backends.base.BaseDatabaseOperations.check_aggregate_support() is removed in Django 2.0.

returntocorp

The django.forms.extras package is removed in Django 2.0.

returntocorp

The weak argument to django.dispatch.signals.Signal.disconnect() is removed in Django 2.0.

returntocorp

You should use ITEM.user_id rather than ITEM.user.id to prevent running an extra query.

returntocorp

deprecated Flask API

returntocorp

Rather than adding one element at a time, consider batch loading to improve performance.

returntocorp

Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side.

returntocorp

manually creating a counter - use collections.Counter

returntocorp

manually creating a defaultdict - use collections.defaultdict(dict)

returntocorp

manually creating a defaultdict - use collections.defaultdict(list)

returntocorp

manually creating a defaultdict - use collections.defaultdict(set)

returntocorp

Class `$A` has defined `__eq__` which means it should also have defined `__hash__`;

returntocorp

file object opened without corresponding close

returntocorp

`pass` is the body of function $X. Consider removing this or raise NotImplementedError() if this is a TODO

returntocorp

`pass` is the body of for $X in $Y. Consider removing this or raise NotImplementedError() if this is a TODO

returntocorp

Importing the python debugger; did you mean to leave this in?

returntocorp

time.sleep() call; did you mean to leave this in?

returntocorp

the `errors` argument to Popen is only available on Python 3.6+

returntocorp

the `encoding` argument to Popen is only available on Python 3.6+

returntocorp

this function is only available on Python 3.6+

returntocorp

this function is only available on Python 3.7+

returntocorp

Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.

returntocorp

Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.

returntocorp

source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function.

returntocorp

Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions.

returntocorp

Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.

returntocorp

IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.

returntocorp

IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.

returntocorp

IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.

returntocorp

IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.

returntocorp

Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument.

returntocorp

math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y.

returntocorp

multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join().

returntocorp

multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate().

returntocorp

os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread().

returntocorp

os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev().

returntocorp

pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument.

returntocorp

Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.

returntocorp

code after return statement will not be executed

returntocorp

`return` only makes sense inside a function

returntocorp

key `$Y` in `$X` is assigned twice; the first assignment is useless

returntocorp

Useless if statement; both blocks have the same body

returntocorp

function `$FF` is defined inside a function but never used

returntocorp

`$X` is uselessly assigned twice inside the creation of the set

returntocorp

Avoid using null on string-based fields such as CharField and TextField. If a string-based field has null=True, that means it has two possible values for "no data": NULL, and the empty string. In most cases, it's redundant to have two possible values for "no data;" the Django convention is to use the empty string, not NULL.

returntocorp

Use 'django.db.models.OneToOneField' instead of 'ForeignKey' with unique=True. 'OneToOneField' is used to create one-to-one relationships.

returntocorp

Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead.

returntocorp

You probably want the structural inequality operator =

returntocorp

You probably want the structural inequality operator <>

returntocorp

This is always true. If testing for floating point NaN, use `Float.is_nan` instead.

returntocorp

Useless if. Both branches are equal.

returntocorp

Useless let

returntocorp

You should probably use Filename.get_temp_dirname().

returntocorp

There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.

returntocorp

Detected conversion of the result of a strconv.Atoi command to an int16. This could lead to an integer overflow, which could possibly result in unexpected behavior and even privilege escalation. Instead, use `strconv.ParseInt`.

returntocorp

Detected conversion of the result of a strconv.Atoi command to an int32. This could lead to an integer overflow, which could possibly result in unexpected behavior and even privilege escalation. Instead, use `strconv.ParseInt`.

returntocorp

Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.MkdirAll, and ioutil.WriteFile

returntocorp

Detected useless comparison operation `$X == $X` or `$X != $X`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression that is not deterministic.

returntocorp

The value of `$X` is being ignored and will be used in the conditional test

returntocorp

This if statement will always have the same behavior and is therefore unnecessary.

returntocorp

Found a FloatField used for variable $F. Use DecimalField for currency fields to avoid float-rounding errors.

returntocorp

Comparison to boolean. Just use `not $X`

returntocorp

Comparison to boolean. Just use `$X`

returntocorp

You should not use Hashtbl.find outside of a try, or you should use Hashtbl.find_opt

returntocorp

Backwards if. Rewrite the code as 'if not $E then $E2'.

returntocorp

Useless else. Just remove the else branch;

returntocorp

You should not use List.find outside of a try, or you should use List.find_opt

returntocorp

You should use `decr`

returntocorp

You should use `incr`

returntocorp

Use instead `Str.first_chars`

returntocorp

Use instead `Str.last_chars`

returntocorp

Use instead `Str.string_after`

returntocorp

Useless sprintf

returntocorp

Pervasives is deprecated and will not be available after 4.10. Use Stdlib.

returntocorp

You probably want $X = [], which is faster.

returntocorp

You probably want $X <> [], which is faster.

returntocorp

`$X` is assigned twice; the first assignment is useless

returntocorp

Unsafe usage of mutable initializer with attr.s decorator. Multiple instances of this class will re-use the same data structure, which is likely not the desired behavior. Consider instead: replace assignment to mutable initializer (ex. dict() or {}) with attr.ib(factory=type) where type is dict, set, or list

returntocorp

Only comparison operators should be used inside SQLAlchemy filter expressions. Use `==` instead of `is`, `!=` instead of `is not`, `sqlalchemy.and_` instead of `and`, `sqlalchemy.or_` instead of `or`, `sqlalchemy.not_` instead of `not`, and `sqlalchemy.in_` instead of `in_`.

returntocorp

`undefined` is not a reserved keyword in Javascript, so this is "valid" Javascript but highly confusing and likely to result in bugs.

returntocorp

found alert() call; should this be in production code?

returntocorp

found confirm() call; should this be in production code?

returntocorp

found debugger call; should this be in production code?

returntocorp

found prompt() call; should this be in production code?

returntocorp

These APIs are deprecated in Bokeh see https://docs.bokeh.org/en/latest/docs/releases.html#api-deprecations

returntocorp

Flask class method GET with side effects

returntocorp

The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good") instead of mystring.replaceAll("bad", "good") (https://discourse.threejs.org/t/replaceall-is-not-a-function/14585)

returntocorp

Detected a channel guarded with a mutex. Channels already have an internal mutex, so this is unnecessary. Remove the mutex. See https://hackmongo.com/page/golang-antipatterns/#guarded-channel for more information.

returntocorp

Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.