Probable Context-Aware Warnings for Floating-Point Equality Comparisons
还没有人认领这个 Issue。
评估
调研方向
Read the issue’s linked Secure Coding Guide section for CWE-664/CWE-197 and review the floating-point equality examples it cites from NeMo and PyTorch. The issue asks whether warnings should be context-dependent, but gives no proposed change or acceptance criteria; done would require agreeing on guidance and updating the relevant guide section to reflect it.
由索引模型根据 Issue 内容生成。
描述
I am working at OpenRefactory, a static analysis tool company. Our CEO, @openrefactorymunawar previously had some interactions with you and we have been improving our tool by adding the capability to detect some of the bugs that you are describing.
I have a question for one such bug pattern.
Recently, we introduced a fixer that flags warnings when floating-point values are used in equality comparisons. This practice is known to be problematic, as it can lead to unexpected outcomes due to the inherent imprecision of floating-point arithmetic.
The idea for this improvement was inspired by the guidance provided in the
Secure Coding Guide for Python (CWE-664/CWE-197)
Upon running this fixer on various projects, we found a significant number of instances where equality comparisons with floating-point values were being used. For example:
PyTorch 67 instances
NVIDIA Nemo 28 instances
Examples of such occurrences:
This raises a question: Could some of these cases be deliberate on the developers' part, where they knowingly use equality comparisons with floating-point values despite the risks, perhaps for a valid use case? If so, should we raise this warning universally, or should it be more context-dependent?
I'd love to hear your thoughts on this.
- 主要语言
- Python
- 星标
- 2
- 派生
- 2
- 平均合并
- 11 分钟
- 30 天内合并 PR
- 2
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ossf/python-secure-coding-guide 的其他 Issue
-
pyscg-0051 should use a context manager可能已有人在做 @s19110 于 8 天前认领。 未关闭bug
难度 2/5 1-3 小时 新手友好度 68/100
ossf/python-secure-coding-guide#1 · 4 条评论 · 已指派 1 人 ·
-
难度 3/5 1-2 天 新手友好度 65/100
ossf/python-secure-coding-guide#29 · 1 条评论 ·
-
难度 5/5 一周以上 新手友好度 25/100
-
难度 4/5 3-5 天 新手友好度 25/100
-
难度 4/5 3-5 天 新手友好度 25/100
查看 ossf/python-secure-coding-guide 的全部 Issue
相似的 Issue
-
documentation type/bug
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 65/100
StevenBlack/hosts#3299 ·
-
`garak --report` overwrites the input report when its name has no ".report"可能已有人在做 @0z5a 今天认领。 未关闭needs-triage
难度 2/5 半天 新手友好度 72/100
维护者通常 2 天内回复
-
trace: Pi's 1-hour cache writes are priced at 1.25x, but billed at 2x可能已有人在做 @Shizoqua 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
microsoft/TokenEconomizer#221 ·
维护者通常 1 天内回复
-
plot_graph crashes when a mesh node has no m2m edge可能已有人在做 @tygvi 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
mllam/neural-lam#883 · 1 条评论 ·
维护者通常 2 天内回复