r2c-best-practices

python.lang.correctness.common-mistakes.default-mutable-dict.default-mutable-dict

semgrep

Function $F mutates default dict $D. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the instance used by all future function calls. This can cause unexpected results, or lead to security vulnerabilities whereby one function consumer can view or modify the data of another function consumer. Instead, use a default argument (like None) to indicate that no argument was provided and instantiate a new dictionary at that time. For example: `if $D is None: $D = {}`.

python.lang.correctness.common-mistakes.default-mutable-list.default-mutable-list

semgrep

Function $F mutates default list $D. Python only instantiates default function arguments once and shares the instance across the function calls. If the default function argument is mutated, that will modify the instance used by all future function calls. This can cause unexpected results, or lead to security vulnerabilities whereby one function consumer can view or modify the data of another function consumer. Instead, use a default argument (like None) to indicate that no argument was provided and instantiate a new list at that time. For example: `if $D is None: $D = []`.

python.lang.correctness.dict-modify-iterating.dict-del-while-iterate

semgrep

It appears that `$DICT[$KEY]` is a dict with items being deleted while in a for loop. This is usually a bad idea and will likely lead to a RuntimeError: dictionary changed size during iteration

python.lang.correctness.useless-eqeq.useless-eqeq

semgrep

This expression is always True: `$X == $X` or `$X != $X`. If testing for floating point NaN, use `math.isnan($X)`, or `cmath.isnan($X)` if the number is complex.

python.lang.correctness.tempfile.flush.tempfile-without-flush

semgrep

Using '$F.name' without '.flush()' or '.close()' may cause an error because the file may not exist when '$F.name' is used. Use '.flush()' or close the file before using '$F.name'.

python.lang.maintainability.useless-ifelse.useless-if-conditional

semgrep

if block checks for the same condition on both branches (`$X`)

go.lang.correctness.useless-eqeq.hardcoded-eq-true-or-false

semgrep

Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on which expression is in the code.

python.lang.correctness.common-mistakes.is-comparison-string.string-is-comparison

semgrep

Found string comparison using 'is' operator. The 'is' operator is for reference equality, not value equality, and therefore should not be used to compare strings. For more information, see https://github.com/satwikkansal/wtfpython#-how-not-to-use-is-operator"

python.lang.correctness.list-modify-iterating.list-modify-while-iterate

semgrep

It appears that `$LIST` is a list that is being modified while in a for loop. This will likely cause a runtime error or an infinite loop.

python.lang.correctness.useless-comparison.no-strings-as-booleans

semgrep

Using strings as booleans in Python has unexpected results. `"one" and "two"` will return "two". `"one" or "two"` will return "one". In Python, strings are truthy, and strings with a non-zero length evaluate to True.

go.lang.maintainability.useless-ifelse.useless-if-body

semgrep

Detected identical statements in the if body and the else body of an if-statement. This will lead to the same code being executed no matter what the if-expression evaluates to. Instead, remove the if statement.

go.lang.maintainability.useless-ifelse.useless-if-conditional

semgrep

Detected an if block that checks for the same condition on both branches (`$X`). The second condition check is useless as it is the same as the first, and therefore can be removed from the code,

java.lang.correctness.eqeq.eqeq

semgrep

`$X == $X` or `$X != $X` is always true. (Unless the value compared is a float or double). To test if `$X` is not-a-number, use `Double.isNaN($X)`.

python.lang.correctness.common-mistakes.is-not-is-not.is-not-is-not

semgrep

In Python 'X is not ...' is different from 'X is (not ...)'. In the latter the 'not' converts the '...' directly to boolean.

java.lang.correctness.no-string-eqeq.no-string-eqeq

semgrep

Strings should not be compared with '=='. This is a reference comparison operator. Use '.equals()' instead.

python.lang.correctness.return-in-init.return-in-init

semgrep

`return` should never appear inside a class __init__ function. This will cause a runtime error.

python.lang.correctness.return-in-init.yield-in-init

semgrep

`yield` should never appear inside a class __init__ function. This will cause a runtime error.

javascript.lang.correctness.useless-eqeq.eqeq-is-bad

semgrep

Detected a useless comparison operation `$X == $X` or `$X != $X`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex.

python.lang.correctness.unchecked-returns.unchecked-subprocess-call

semgrep

This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead

python.lang.correctness.common-mistakes.is-comparison-string.identical-is-comparison

semgrep

Found identical comparison using is. Ensure this is what you intended.

python.lang.correctness.exceptions.exceptions.raise-not-base-exception

semgrep

In Python3, a runtime `TypeError` will be thrown if you attempt to raise an object or class which does not inherit from `BaseException`

python.lang.correctness.exit.use-sys-exit

semgrep

Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.

python.lang.correctness.common-mistakes.string-concat-in-list.string-concat-in-list

semgrep

Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?

python.requests.best-practice.use-timeout.use-timeout

semgrep

Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.

python.lang.correctness.tempfile.mktemp.tempfile-insecure

semgrep

Use tempfile.NamedTemporaryFile instead. From the official Python documentation: THIS FUNCTION IS UNSAFE AND SHOULD NOT BE USED. The file name may refer to a file that did not exist at some point, but by the time you get around to creating it, someone else may have beaten you to the punch.

python.django.correctness.nontext-field-must-set-null-true.nontext-field-must-set-null-true

semgrep

null=True should be set if blank=True is set on non-text fields.

python.django.correctness.string-field-null-checks.string-field-must-set-null-true

semgrep

If a text field declares unique=True and blank=True, null=True must also be set to avoid unique constraint violations when saving multiple objects with blank values.

semgrep

Use JsonResponse instead

semgrep

Looks like you need to determine the number of records. Django provides the count() method which is more efficient than .len(). See https://docs.djangoproject.com/en/3.0/ref/models/querysets/

semgrep

Looks like you are only accessing first element of an ordered QuerySet. Use `latest()` or `earliest()` instead. See https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.latest

semgrep

You are using environment variables inside django app. Use `django-environ` as it a better alternative for deployment.

semgrep

Class $C inherits from both `$A` and `$B` which both have a method named `$F`; one of these methods will be overwritten.

semgrep

Values returned by thread pool map must be read in order to raise exceptions. Consider using `for _ in $EXECUTOR.map(...): pass`.

semgrep

Detected a file object that is redefined and never closed. This could leak file descriptors and unnecessarily consume system resources.

semgrep

pdb is an interactive debugging tool and you may have forgotten to remove it before committing your code

semgrep

The file object '$FD' was opened in read mode, but is being written to. This will cause a runtime error.

semgrep

Accessing request object inside a route handle for HTTP GET command will throw due to missing request body.

semgrep

flask.jsonify() is a Flask helper method which handles the correct settings for returning JSON from Flask routes

semgrep

Detected a django model `$MODEL` is not calling super().save() inside of the save method.

semgrep

Looks like `$R` is a flask function handler that registered to two different routes. This will cause a runtime error

semgrep

.delete().where(...) results in a no-op in SQLAlchemy unless the command is executed, use .filter(...).delete() instead.

semgrep

Use `click.secho($X)` instead. It combines click.echo() and click.style().

semgrep

The host argument to assertRedirects is removed in Django 2.0.

semgrep

The assignment_tag helper is removed in Django 2.0.

semgrep

django.db.backends.base.BaseDatabaseOperations.check_aggregate_support() is removed in Django 2.0.

semgrep

The django.forms.extras package is removed in Django 2.0.

semgrep

The weak argument to django.dispatch.signals.Signal.disconnect() is removed in Django 2.0.

semgrep

You should use ITEM.user_id rather than ITEM.user.id to prevent running an extra query.

semgrep

deprecated Flask API

semgrep

Rather than adding one element at a time, consider batch loading to improve performance.

semgrep

Using QUERY.count() instead of len(QUERY.all()) sends less data to the client since the SQLAlchemy method is performed server-side.

semgrep

manually creating a counter - use collections.Counter

semgrep

manually creating a defaultdict - use collections.defaultdict(dict)

semgrep

manually creating a defaultdict - use collections.defaultdict(list)

semgrep

manually creating a defaultdict - use collections.defaultdict(set)

semgrep

Class `$A` has defined `__eq__` which means it should also have defined `__hash__`;

semgrep

file object opened without corresponding close

semgrep

`pass` is the body of function $X. Consider removing this or raise NotImplementedError() if this is a TODO

semgrep

`pass` is the body of for $X in $Y. Consider removing this or raise NotImplementedError() if this is a TODO

semgrep

Importing the python debugger; did you mean to leave this in?

semgrep

time.sleep() call; did you mean to leave this in?

semgrep

the `errors` argument to Popen is only available on Python 3.6+

semgrep

the `encoding` argument to Popen is only available on Python 3.6+

semgrep

this function is only available on Python 3.6+

semgrep

Found usage of the 'blocksize' argument in a HTTPConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.

semgrep

Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.

semgrep

source_hash' is only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Instead, use another hash function.

semgrep

Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions.

semgrep

Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.

semgrep

IPv4Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.

semgrep

IPv4Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.

semgrep

IPv6Network.subnet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the subnet is in 'subnets'.

semgrep

IPv6Network.supernet_of is only available on Python 3.7+ and is therefore not backwards compatible. Instead, check if the supernet is in 'supernet'.

semgrep

Found usage of the 'monetary' argument in a function call of 'locale.format_string'. This is only available on Python 3.7+ and is therefore not backwards compatible. Instead, remove the 'monetary' argument.

semgrep

math.remainder is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use math.fmod() or calculate $X - n* $Y.

semgrep

multiprocessing.Process.close() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use join().

semgrep

multiprocessing.Process.kill() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use terminate().

semgrep

os.preadv() is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use a combination of os.readv() and os.pread().

semgrep

os.pwritev() is only available on Python 3.3+ and is therefore not backwards compatible. Instead, use a combination of pwrite() and writev().

semgrep

pdb.set_trace() with the header argument is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use set_trace() without the header argument.

semgrep

Found usage of 'importlib.abc.ResourceReader'. This module is only available on Python 3.7+ and is therefore not backwards compatible. Instead, use another loader.

semgrep

code after return statement will not be executed

semgrep

`return` only makes sense inside a function

semgrep

key `$Y` in `$X` is assigned twice; the first assignment is useless

semgrep

Useless if statement; both blocks have the same body

semgrep

function `$FF` is defined inside a function but never used

semgrep

Avoid using null on string-based fields such as CharField and TextField. If a string-based field has null=True, that means it has two possible values for "no data": NULL, and the empty string. In most cases, it's redundant to have two possible values for "no data;" the Django convention is to use the empty string, not NULL.

semgrep

Use 'django.db.models.OneToOneField' instead of 'ForeignKey' with unique=True. 'OneToOneField' is used to create one-to-one relationships.

semgrep

Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead.

semgrep

There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.

semgrep

Detected conversion of the result of a strconv.Atoi command to an int16. This could lead to an integer overflow, which could possibly result in unexpected behavior and even privilege escalation. Instead, use `strconv.ParseInt`.

semgrep

Detected conversion of the result of a strconv.Atoi command to an int32. This could lead to an integer overflow, which could possibly result in unexpected behavior and even privilege escalation. Instead, use `strconv.ParseInt`.

semgrep

Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.MkdirAll, and ioutil.WriteFile

semgrep

Detected useless comparison operation `$X == $X` or `$X != $X`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression that is not deterministic.

semgrep

The value of `$X` is being ignored and will be used in the conditional test

semgrep

This if statement will always have the same behavior and is therefore unnecessary.

semgrep

Found a FloatField used for variable $F. Use DecimalField for currency fields to avoid float-rounding errors.

semgrep

Comparison to boolean. Just use `not $X`

semgrep

Comparison to boolean. Just use `$X`

semgrep

You should not use Hashtbl.find outside of a try, or you should use Hashtbl.find_opt

semgrep

Backwards if. Rewrite the code as 'if not $E then $E2'.

semgrep

Useless else. Just remove the else branch;

semgrep

You should not use List.find outside of a try, or you should use List.find_opt

semgrep

You should use `decr`

semgrep

You should use `incr`

semgrep

Use instead `Str.first_chars`

semgrep

Use instead `Str.last_chars`

semgrep

Use instead `Str.string_after`

semgrep

Useless sprintf

semgrep

Pervasives is deprecated and will not be available after 4.10. Use Stdlib.

semgrep

You probably want $X = [], which is faster.

semgrep

You probably want $X <> [], which is faster.

semgrep

`$X` is assigned twice; the first assignment is useless

semgrep

Unsafe usage of mutable initializer with attr.s decorator. Multiple instances of this class will re-use the same data structure, which is likely not the desired behavior. Consider instead: replace assignment to mutable initializer (ex. dict() or {}) with attr.ib(factory=type) where type is dict, set, or list

semgrep

Only comparison operators should be used inside SQLAlchemy filter expressions. Use `==` instead of `is`, `!=` instead of `is not`, `sqlalchemy.and_` instead of `and`, `sqlalchemy.or_` instead of `or`, `sqlalchemy.not_` instead of `not`, and `sqlalchemy.in_` instead of `in_`.

semgrep

`undefined` is not a reserved keyword in Javascript, so this is "valid" Javascript but highly confusing and likely to result in bugs.

semgrep

found alert() call; should this be in production code?

semgrep

found confirm() call; should this be in production code?

semgrep

found debugger call; should this be in production code?

semgrep

found prompt() call; should this be in production code?

semgrep

These APIs are deprecated in Bokeh see https://docs.bokeh.org/en/latest/docs/releases.html#api-deprecations

semgrep

Flask class method GET with side effects

semgrep

The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good") instead of mystring.replaceAll("bad", "good") (https://discourse.threejs.org/t/replaceall-is-not-a-function/14585)

semgrep

Detected a channel guarded with a mutex. Channels already have an internal mutex, so this is unnecessary. Remove the mutex. See https://hackmongo.com/page/golang-antipatterns/#guarded-channel for more information.

semgrep

Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.