mcp-server-semgrep/semgrep-rules/python/attr/correctness/mutable-initializer.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: attr-mutable-initializer
    patterns:
      - pattern-not-inside: |
          def $Y(...):
            ...
      - pattern-not-inside: |
          def $Y(...) -> $TYPE:
            ...
      - pattern-either:
          - pattern-inside: |
              @attr.s(...,auto_attribs=True, ...)
              class $X(...):
                ...
          - pattern-inside: |
              @attrs.define
              class $X(...):
                ...
      - pattern-either:
          - pattern: |
              $M = {...}
          - pattern: $M = [...]
          - pattern: $M = list(...)
          - pattern: $M = set(...)
          - pattern: $M = dict(...)
    message: >-
      Unsafe usage of mutable initializer with attr.s decorator.
      Multiple instances of this class will re-use the same data structure, which is likely not the desired behavior.
      Consider instead: replace assignment to mutable initializer (ex. dict() or {}) with attr.ib(factory=type) where type is dict, set, or list
    severity: WARNING
    languages:
      - python
    metadata:
      category: correctness
      technology:
        - attr