False-positive on python:S4143

  • Operating system: Ubuntu 20.04
  • SonarLint plugin version: 3.22.0
  • Programming language you’re coding in: Python
  • Is connected mode used: Connected to SonarCloud


I’ve encountered a potential false positive with SonarLint when working with pandas DataFrames in Python. Here’s a simplified working example of the code:

import pandas as pd

# Sample data
bar_list = ['A', 'B', 'C']
foo_df = pd.DataFrame({
    'FOO': ['A', 'B', 'C'],
    'BAR': ['B', 'C', 'A'],
    'VALUE1': [1, 2, 3],
    'VALUE2': [4, 5, 6]

foo_key = 'FOO'
bar_key = 'BAR'
def main():
    foo_matrix = pd.DataFrame(index=bar_list, columns=bar_list)
    bar_matrix = pd.DataFrame(index=bar_list, columns=bar_list)

    for _, row in foo_df.iterrows():
        foo_entry = row.VALUE1
        bar_entry = row.VALUE2
        foo_value = row.VALUE3
        bar_value = row.VALUE4

        foo_matrix.loc[foo_entry, bar_entry] = foo_value
        bar_matrix.loc[foo_entry, bar_entry] = bar_value

Screenshot of the problem:

The following lines are flagged

foo_matrix.loc[foo_entry, bar_entry] = foo_value
bar_matrix.loc[foo_entry, bar_entry] = bar_value

with a warning that the value set in the first line might be overwritten by the second line. However, these lines are writing to two different DataFrames (foo_matrix and bar_matrix), so they cannot overwrite each other’s values.

Is that intended? A workaround to avoid the warning is the following, but it doesn’t feels right.

    for _, row in foo_df.iterrows():
        foo_matrix.loc[row.VALUE1, row.VALUE2] = row.VALUE3
        bar_matrix.loc[row.VALUE1, row.VALUE2] = row.VALUE4

Hello @ctamblay,

First of all, welcome to the Sonar community!

Big thanks for the issue reporting. We’ve created the SONAPY-1521 ticket, which we already fixed and should be delivered in the next version of the analyzer.

By the way, I see you’re using Pandas, you might be interested to know we just announced 5 New Rules for Clean Code with the Pandas Library. We’d certainly love to have your feedback about these.

Maksim Grebeniuk