Probable Context-Aware Warnings for Floating-Point Equality Comparisons

Abierto
  • ¿Algo no está bien?
#15 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
25/100
Tipo de issue
Documentación
Claridad
Necesita aclaración
Estado de actividad
Estancado
Stack tecnológico
python
Área
security

Línea de trabajo

Read the issue’s linked Secure Coding Guide section for CWE-664/CWE-197 and review the floating-point equality examples it cites from NeMo and PyTorch. The issue asks whether warnings should be context-dependent, but gives no proposed change or acceptance criteria; done would require agreeing on guidance and updating the relevant guide section to reflect it.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

I am working at OpenRefactory, a static analysis tool company. Our CEO, @openrefactorymunawar previously had some interactions with you and we have been improving our tool by adding the capability to detect some of the bugs that you are describing.

I have a question for one such bug pattern.

Recently, we introduced a fixer that flags warnings when floating-point values are used in equality comparisons. This practice is known to be problematic, as it can lead to unexpected outcomes due to the inherent imprecision of floating-point arithmetic.
The idea for this improvement was inspired by the guidance provided in the
Secure Coding Guide for Python (CWE-664/CWE-197)

Upon running this fixer on various projects, we found a significant number of instances where equality comparisons with floating-point values were being used. For example:

PyTorch 67 instances
NVIDIA Nemo 28 instances

Examples of such occurrences:

  1. Nemo
  2. NeMo
  3. pytorch

This raises a question: Could some of these cases be deliberate on the developers' part, where they knowingly use equality comparisons with floating-point values despite the risks, perhaps for a valid use case? If so, should we raise this warning universally, or should it be more context-dependent?

I'd love to hear your thoughts on this.

Lenguaje dominante
Python
Estrellas
2
Forks
2
Merge medio
11 min
PR fusionados (30 d)
2

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ossf/python-secure-coding-guide

Todos los issues de ossf/python-secure-coding-guide

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.