crates.io / base64 / 0.23.1

base64 0.23.1

Source
https://github.com/marshallpierce/rust-base64
Artifact scanned
base64-0.23.1.crate (crate · 91.4 KB · SHA-256 ac07cdecf990…)
Compared with
base64-0.23.0.crate (0 signals introduced since)
Files
30 scanned, 9 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 9 info
Scan time
6.6 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-24 01:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review encoding-base64 src/chunked_encoder.rs:100:14

    base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)

            assert_eq!(
                "Zm9vYmFyYmF6cXV4cXV1eGNvcmdlZ3JhdWx0Z2FycGx5eg==",
                chunked_encode_str(b"foobarbazquxquuxcorgegraultgarplyz", PAD)
            );
    likely benign LLM, confidence 0.97 Unit test asserting the chunked base64 encoder output for a fixed input.
    Reasoning

    The snippet is an assert_eq comparing a known base64 string against chunked_encode_str output for a fixed plaintext. This is a standard encoder unit test with expected output, not obfuscation.

  2. info warn → info by review encoding-base64 src/engine/tests.rs:261:10

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        let alphabet = Alphabet::new_with_padding(
            "4QTRhE+Hiz0Nme6DsnuAFCP8WaojxdVOZpKL53r2=BIkqSUcbYJG91tvX7lywMgf",
            Symbol::new(b'-').unwrap(),
        )
    likely benign LLM, confidence 0.97 Test constructing a custom base64 alphabet with padding symbol.
    Reasoning

    The literal is a custom 64-character alphabet passed to Alphabet::new_with_padding in a test. Custom alphabets are a normal feature of a base64 library and the file is a test module.

  3. info warn → info by review encoding-base64 src/engine/tests.rs:788:16

    base64-like blob (128 bytes, compression ratio 1.00) (raw pass, confidence 0.60)

    fn detects_users_real_world_invalid_suffix<E: EngineWrapper>(engine_wrapper: E) {
        let b64 = "z3Uuv7+Xsn+acg0ZNRsw1/ZEl1FJEMw3kV0N0MaAZuEqXsMjfR2AE51PUsgwNEY4c+PdL3UxO/kcDInOe4+MiyeJL2mAapHLXk+7PBQ6hdqt5Oy4rwOIW4TvRzGHAW==";
    
        let engine = E::standard();
    likely benign LLM, confidence 0.96 Test fixture containing a malformed base64 string to exercise invalid-suffix handling.
    Reasoning

    The high-entropy literal is test input for a test named detects_users_real_world_invalid_suffix, used to check decoding of a malformed base64 string. It is data for a decoder test, not a payload being executed.

  4. info warn → info by review high-complexity src/engine/tests.rs:788:16

    string literal compression ratio 0.953 (128 bytes) (raw pass, confidence 0.60)

    fn detects_users_real_world_invalid_suffix<E: EngineWrapper>(engine_wrapper: E) {
        let b64 = "z3Uuv7+Xsn+acg0ZNRsw1/ZEl1FJEMw3kV0N0MaAZuEqXsMjfR2AE51PUsgwNEY4c+PdL3UxO/kcDInOe4+MiyeJL2mAapHLXk+7PBQ6hdqt5Oy4rwOIW4TvRzGHAW==";
    
        let engine = E::standard();
    likely benign LLM, confidence 0.96 Same malformed base64 test fixture, flagged for high complexity.
    Reasoning

    This is the same test fixture literal as the base64 finding on the same line, flagged for low compression. Random-looking test data is expected for a base64 decoder test.

  5. info warn → info by review encoding-base64 tests/encode.rs:14:10

    base64-like blob (81 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

        compare_encode(
            "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7P\
             D0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn8\
             =",
    likely benign LLM, confidence 0.97 Test vector of all byte values in base64 for an encode comparison.
    Reasoning

    The literal is the sequential byte sequence 0x00 to 0xFF encoded in base64 with a padding character, used as an expected encoding vector in a conformance test.

  6. info warn → info by review encoding-base64 tests/encode.rs:15:10

    base64-like blob (90 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

            "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7P\
             D0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn8\
             =",
            &ascii,
    likely benign LLM, confidence 0.97 Continuation of the all-bytes base64 test vector.
    Reasoning

    This is the continuation of the same all-bytes base64 test vector, split across string-continuation lines in a test file.

  7. info warn → info by review encoding-base64 tests/encode.rs:26:10

    4 rows of base64-like lines, lines 26-29 (first: base64-like blob (81 bytes, compression ratio 1.14)) (raw pass, confidence 0.60)

        compare_encode(
            "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7P\
             D0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn\
             +AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6\
    likely benign LLM, confidence 0.97 Multi-line base64 expected output in an encoding comparison test.
    Reasoning

    The multi-line base64 literal is a sequential-byte encoding expected output in a compare_encode test. Its line layout is consistent with a test table.

  8. info warn → info by review encoding-base64 tests/encode.rs:39:10

    base64-like blob (83 bytes, compression ratio 1.13) (raw pass, confidence 0.60)

        assert_eq!(
            "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0\
             -P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn\
             -AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq\
    likely benign LLM, confidence 0.97 URL-safe base64 expected output for the all-bytes vector in a test assertion.
    Reasoning

    This is another expected base64 encoding of sequential bytes used in an assert_eq within a conformance test, using the URL-safe alphabet with '-' characters.

  9. info warn → info by review encoding-base64 tests/encode.rs:40:11

    base64-like blob (86 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

            "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0\
             -P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn\
             -AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq\
    likely benign LLM, confidence 0.97 Continuation of the URL-safe all-bytes base64 test vector.
    Reasoning

    This is the continuation of the URL-safe all-bytes test vector in the same assertion, consistent with a standard encoding test.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o base64-0.23.1.crate 'https://static.crates.io/crates/base64/base64-0%2E23%2E1.crate'
printf '%s  %s\n' ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5 base64-0.23.1.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf base64-0.23.1.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg