Probable Context-Aware Warnings for Floating-Point Equality Comparisons

Aberta
  • Algo errado?
#15 3 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
25/100
Tipo de issue
Documentação
Clareza
Precisa de esclarecimento
Status de atividade
Estagnada
Stack de tecnologia
python
Domínio
security

Direção de pesquisa

Read the issue’s linked Secure Coding Guide section for CWE-664/CWE-197 and review the floating-point equality examples it cites from NeMo and PyTorch. The issue asks whether warnings should be context-dependent, but gives no proposed change or acceptance criteria; done would require agreeing on guidance and updating the relevant guide section to reflect it.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

I am working at OpenRefactory, a static analysis tool company. Our CEO, @openrefactorymunawar previously had some interactions with you and we have been improving our tool by adding the capability to detect some of the bugs that you are describing.

I have a question for one such bug pattern.

Recently, we introduced a fixer that flags warnings when floating-point values are used in equality comparisons. This practice is known to be problematic, as it can lead to unexpected outcomes due to the inherent imprecision of floating-point arithmetic.
The idea for this improvement was inspired by the guidance provided in the
Secure Coding Guide for Python (CWE-664/CWE-197)

Upon running this fixer on various projects, we found a significant number of instances where equality comparisons with floating-point values were being used. For example:

PyTorch 67 instances
NVIDIA Nemo 28 instances

Examples of such occurrences:

  1. Nemo
  2. NeMo
  3. pytorch

This raises a question: Could some of these cases be deliberate on the developers' part, where they knowingly use equality comparisons with floating-point values despite the risks, perhaps for a valid use case? If so, should we raise this warning universally, or should it be more context-dependent?

I'd love to hear your thoughts on this.

Linguagem predominante
Python
Estrelas
2
Forks
2
Merge médio
11min
PRs com merge (30d)
2

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de ossf/python-secure-coding-guide

Todas as issues de ossf/python-secure-coding-guide

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.