Test 5 mini fp by unnat-deepsource · Pull Request #94 · CyberdyneHQ/demo-python

unnat-deepsource · 2026-04-20T08:43:23Z

No description provided.

deepsource-development · 2026-04-20T08:43:37Z

DeepSource Code Review

We reviewed changes in 9d1323c...f634b03 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade Focus Area: Reliability	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Apr 20, 2026 8:46a.m.	Review ↗
Secrets		Apr 20, 2026 8:46a.m.	Review ↗

deepsource-development · 2026-04-20T08:43:44Z

+    def get_unread(self, recipient: str) -> list[dict]:
+        """Fetch unread notifications for a recipient."""
+        conn = self._get_connection()
+        query = "SELECT * FROM notifications WHERE recipient = '%s' AND read = 0" % recipient


Possible SQL injection vector through string-based query construction.

Constructing SQL query using user provided data is insecure. It makes application vulnerable to [SQL injection](SQL injection) attacks.

deepsource-development · 2026-04-20T08:43:44Z

+    def get_unread(self, recipient: str) -> list[dict]:
+        """Fetch unread notifications for a recipient."""
+        conn = self._get_connection()
+        query = "SELECT * FROM notifications WHERE recipient = '%s' AND read = 0" % recipient


Formatting a regular string which could be a f-string

f-strings are the fastest way to format strings as compared to the following methods: * using format specifiers %

deepsource-development · 2026-04-20T08:43:44Z

+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass, field


Unused field imported from dataclasses

An object has been imported but is not used anywhere in the file.
It should either be used or the import should be removed.

deepsource-development · 2026-04-20T08:43:44Z

+        product.quantity += quantity
+        return product
+
+    def get_low_stock(self, categories: list[str] = []) -> list[Product]:


Dangerous default value [] as argument

Do not use a mutable like list or dictionary as a default value to an argument. Python’s default arguments are evaluated once when the function is defined. Using a mutable default argument and mutating it will mutate that object for all future calls to the function as well.

deepsource-development · 2026-04-20T08:43:44Z

+        ]
+        return low
+
+    def bulk_update_prices(self, updates: dict[str, float] = {}) -> int:


Dangerous default value {} as argument

Do not use a mutable like list or dictionary as a default value to an argument. Python’s default arguments are evaluated once when the function is defined. Using a mutable default argument and mutating it will mutate that object for all future calls to the function as well.

deepsource-development · 2026-04-20T08:43:44Z

+                if fields:
+                    entry = {k: v for k, v in entry.items() if k in fields}
+                snapshot.append(entry)
+            except:


do not use bare 'except'

Using except without a specific exception can be error prone.

deepsource-development · 2026-04-20T08:43:45Z

+                }
+                for row in cursor.fetchall()
+            ]
+        except:


do not use bare 'except'

Using except without a specific exception can be error prone.

deepsource-development · 2026-04-20T08:43:45Z

+    def generate_csv(
+        self,
+        data: list[dict[str, Any]],
+        filters: dict[str, Any] = {},


Dangerous default value {} as argument

Do not use a mutable like list or dictionary as a default value to an argument. Python’s default arguments are evaluated once when the function is defined. Using a mutable default argument and mutating it will mutate that object for all future calls to the function as well.

deepsource-development · 2026-04-20T08:43:45Z

+    def generate_text_summary(
+        self,
+        data: list[dict[str, Any]],
+        columns: list[str] = [],


Dangerous default value [] as argument

Do not use a mutable like list or dictionary as a default value to an argument. Python’s default arguments are evaluated once when the function is defined. Using a mutable default argument and mutating it will mutate that object for all future calls to the function as well.

deepsource-development · 2026-04-20T08:43:45Z

+        lines.append(f"Total: {len(data)} records")
+        return "\n".join(lines)
+
+    def generate_summary_stats(


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

unnat-deepsource · 2026-04-20T08:45:57Z

@deepsourcebot review

deepsource-development · 2026-04-20T08:49:11Z

+        except:
+            logger.warning("Failed to remove product: %s", sku)
+            return None


Bare `except` masks non-recoverable runtime failures

A bare except catches KeyboardInterrupt and SystemExit alongside expected lookup errors. This hides real defects and can keep the process running in corrupted states while callers only see None.

Catch KeyError explicitly and log unexpected exceptions separately with except Exception before re-raising.

deepsource-development · 2026-04-20T08:49:11Z

+            except:
+                logger.error("Failed to export product %s", product.sku)


Bare `except` hides export data corruption causes

Catching every exception makes export reliability opaque and can silently lose inventory records. Operators only get a generic log message, while the root error and stack context are discarded.

Use except Exception as exc with logger.exception(...), and consider re-raising or collecting failed SKUs for explicit caller handling.

deepsource-development · 2026-04-20T08:49:11Z

+    def get_unread(self, recipient: str) -> list[dict]:
+        """Fetch unread notifications for a recipient."""
+        conn = self._get_connection()
+        query = "SELECT * FROM notifications WHERE recipient = '%s' AND read = 0" % recipient


`%` SQL formatting enables `recipient` query injection

get_unread constructs query with % interpolation of untrusted recipient. Attackers can alter the WHERE clause and read notifications not belonging to them.

Replace string formatting with parameterized SQL using ? placeholders and pass (recipient,) to execute

deepsource-development · 2026-04-20T08:49:11Z

+        except:
+            logger.error("Failed to fetch notifications for %s", recipient)
+            return []


`except:` hides runtime failures and returns stale behavior

get_unread swallows every exception and returns [], making real database or schema failures look like no unread notifications. This can suppress alerts and mislead downstream logic.

Replace except: with except sqlite3.Error as exc, log exc, and re-raise or return a typed error outcome

deepsource-development · 2026-04-20T08:49:11Z

+    def generate_csv(
+        self,
+        data: list[dict[str, Any]],
+        filters: dict[str, Any] = {},


Mutable `filters={}` default risks shared state bugs

filters uses a mutable default object. Even though current code does not mutate it, later edits can accidentally persist values across calls and create hard-to-debug cross-request coupling.

Replace with None and initialize inside the method using filters = {} if filters is None else filters.

deepsource-development · 2026-04-20T08:49:11Z

+        self,
+        data: list[dict[str, Any]],
+        numeric_field: str,
+        group_by: Optional[str] = None,


Unused `group_by` parameter breaks advertised grouped statistics

The API accepts group_by but never applies grouping. Callers expecting per-group metrics silently receive global numbers, which can corrupt dashboards and downstream decisions.

Implement grouping when group_by is provided, or remove the parameter and update docstrings to match actual behavior.

rupin-deepsource · 2026-04-20T09:07:18Z

@deepsourcebot review

unnat-deepsource added 2 commits April 20, 2026 13:24

add code

8499f55

cleanup

f634b03

unnat-deepsource requested a review from srijan-deepsource as a code owner April 20, 2026 08:43

deepsource-development Bot reviewed Apr 20, 2026

View reviewed changes

		except:
		logger.error("Failed to export product %s", product.sku)

Uh oh!

Conversation

unnat-deepsource commented Apr 20, 2026

Uh oh!

deepsource-development Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Possible SQL injection vector through string-based query construction.

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Formatting a regular string which could be a f-string

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Unused field imported from dataclasses

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Dangerous default value [] as argument

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Dangerous default value {} as argument

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

do not use bare 'except'

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

do not use bare 'except'

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Dangerous default value {} as argument

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Dangerous default value [] as argument

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

unnat-deepsource commented Apr 20, 2026

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Bare `except` masks non-recoverable runtime failures

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Bare `except` hides export data corruption causes

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

`%` SQL formatting enables `recipient` query injection

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

`except:` hides runtime failures and returns stale behavior

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Mutable `filters={}` default risks shared state bugs

Uh oh!

deepsource-development Bot Apr 20, 2026

Choose a reason for hiding this comment

Unused `group_by` parameter breaks advertised grouped statistics

Uh oh!

rupin-deepsource commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

deepsource-development Bot commented Apr 20, 2026 •

edited

Loading