False positive for Python Flask 2.2, unexpected named argument, Flask.send_file 'dowload_name'

[harryhartmann]

• Operating system: Ubuntu 20
• IDE name and flavor/env: PyCharm

Description:
false positive for Python Flask 2.2, Bug, Blocker,
unexpected named argument, Flask.send_file ‘dowload_name’, relevant code snippet:

return send_file(
      status.message,
      mimetype=APPLICATION_MIME_TYPE,
      as_attachment=True,
      download_name=f"{analytics.filename}.zip",
)

SonarLint is embedded as a Tool in:
. IDE, PyCharm 2022.2.1 (Professional Edition)
. .not bind Project to SonarQube/SonarCloud
. .no file exlussion
. .no Analysis properties
Language: Python
. Package : Flask 2.2
… Funtion: flask.send_file
SonarSource: 7.0.0.52289

It seems to me to be a false positive. I have two questions:
How can I block this false positive for my IDE (PyCharm.Professional)?
The same issue is raised on SonarQube, integrated and used in CI/CD project pipeline. How can I block this false positive on SonarQube server?

Thank you, Harry.

[Colin]

Hey there.

I’ve moved your post to the section on reporting false-postives.

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Can you please review this thread and add the missing information? Specifically – what version of SonarLint you’re using, and if you’re using connected mode.

[harryhartmann]

will follow the suggested review recommendations, Thank you very much for response.

[Damien_Urruty]

Hello Harry,

Would it be possible for you to provide a small, self-contained reproducer example project ? You can upload an archive on this thread. That would greatly help us.

@harryhartmann

How can I block this false positive on SonarQube server

You can navigate to the issue on SonarQube and change the status from ‘Open’ to ‘False Positive’. See here for more details. By the way, what is your SonarQube server version ?

@harryhartmann

How can I block this false positive for my IDE (PyCharm.Professional)?

You will need to connect your IDE project to your SonarQube project thanks to SonarLint. Once the issue is marked as ‘False Positive’ on the server, it should automatically be reflected in your IDE

[harryhartmann]

working on upload …, thank you advice

[harryhartmann]

git clone GitHub - HarryHartmann/flaskProjectSonarQubeFalsePositive

[Guillaume_Dequenne]

Hello @harryhartmann,

Sorry for the late answer.

I have created the following ticket to track this FP. Unfortunately, it is not an easy fix on our side, as we used to rely on typeshed to retrieve type information for Flask, but we are temporarily stuck with a slightly outdated version for now due to changes in the distribution of those stubs, for which we need to adapt the analyzer.

In the meantime, using the #NOSONAR annotation on the FP, or disabling the offending rule, is your best bet.

Hope that helps,
Guillaume