CVE-2021-3129 | Laravel v8.4.2 debug mode | Code Inspection library

I found that there is lint configuration in the code, so just disable and the alert will gone.

In analysis_options.yaml file, disable the 80 chars rule:

The type checker is warning you that your dictionary that maps AST node types for operators to their implementations is incomplete. The type checker knows all of the possible types of node.op (which it seems to be describing as subtypes of the ast.operator and ast.unaryop parent types), and has noticed that your dictionary doesn't handle them all.

Since there are operators that you haven't included, it's possible for a parsable expression (like, say "2 << 5" which does a left shift, or "~31" which does a bitwise inversion) to fail to be handled by your code.

While I don't use PyCharm and thus can't test it for myself, you can probably satisfy its type checker by adding some error handling to your code, so that operator types you don't support will still be dealt with appropriately, rather than causing an uncaught exception (such as a KeyError from the dictionary) to leak out. For instance, you could use OPERATORS.get(type(node.op)) and then test for None before calling the result. If the operator type isn't in the dictionary, you'd raise an exception of your own.

The IDE only looks for CSS selector usages in stylesheets and HTML files/fragments; it won't inspect plain text files and files of unknown type. I've just checked - CSS usages are correctly found in Velocity templates:

Make sure to add *.vtl pattern to Velocity Template file type in Settings | Editor | File Types

It's because you didn't specify a parameter for the -d option.

-d

It should be like this:

As it says: "varargs and keywords are the names of the * and ** arguments". Your function doesn't have any * or ** arguments.

The * that appears here:

C26434 warning documentation links to C.128 C++ Core Guidelines Rule. It explains that to enforce correct usage of virtual functions, non-virtual function hiding should produce a warning.

However, with MFC message maps, you have to name your message handler as specified in macro, OnSize in this case, and, since message handlers already dispatched by a virtual function (that is hidden in *_MESSAGE_MAP() macros), message handler by themselves don't have to be virtual.

So it may be seen as a false alarm. Or maybe seen as violation of the above mentioned C.128 rule by MFC itself. No surprise - MFC is decades older than these guidelines.

So I guess you can go ahead and suppress it for all afx_msg functions. Maybe redefine afx_msg to include __pragma(warning(suppress(...))), or just have suppression around afx_msg block.

Some options for suppression (Godbolt's compiler explorer demo):

It's not well formatted, but I captured this by curling the url.

Submitted to developers, please vote for WEB-48756 to be notified on any progress with it

Get the SemanticModel for your tree, then call GetDeclaredSymbol() with the ClassDeclarationSyntax. That'll give you the ITypeSymbol and you can look at BaseType from there. You don't want to try this with syntax only because of partial classes.