mcp-server-semgrep/semgrep-rules/python/lang/correctness/common-mistakes/default-mutable-list.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: default-mutable-list
    message: >-
      Function $F mutates default list $D. Python only instantiates default function
      arguments once and shares the
      instance across the function calls. If the default function argument is mutated,
      that will modify the
      instance used by all future function calls. This can cause
      unexpected results, or lead to security vulnerabilities whereby one function consumer
      can view or modify the data
      of another function consumer. Instead, use a default argument (like None) to indicate
      that no argument was provided
      and instantiate a new list at that time. For example: `if $D is None: $D = []`.
    languages: [python]
    severity: ERROR
    options:
      symbolic_propagation: true
    patterns:
      - pattern-not-inside: |
          def $A(...):
            ...
            def $F(..., $D=[], ...):
              ...
      - pattern-inside: |
          def $F(..., $D=[], ...):
            ...
      - pattern-not-inside: |
            $D = []
            ...
      - pattern-not-inside: |
            $D = [...]
            ...
      - pattern-not-inside: |
            $D = list(...)
            ...
      - pattern-not-inside: |
            $D = copy.deepcopy($D)
            ...
      - pattern-not-inside: |
            $D = copy.copy($D)
            ...
      - pattern-not-inside: |
            $D = list.copy($D)
            ...
      - pattern-not-inside: |
            $D = $D[:]
            ...
      - pattern-not-inside: |
            $D = [... for ... in ...]
            ...
      - pattern-not-inside: |
            $D = $D or []
            ...
      - pattern-either:
          - pattern: |
              $D.append(...)
          - pattern: |
              $D.extend(...)
          - pattern: |
              $D.insert(...)
    metadata:
      category: correctness
      technology:
        - python
      references:
        - https://docs.python-guide.org/writing/gotchas/#mutable-default-arguments