brotli-decompressor 6.1.1

Source: https://github.com/dropbox/rust-brotli-decompressor
Artifact scanned: brotli-decompressor-6.1.1.crate (crate · 264.8 KB · SHA-256 28a996bd762f…)
Compared with: brotli-decompressor-6.1.0.crate (0 signals introduced since)
Files: 36 scanned, 11 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 6 info
Scan time: 4.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 02:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-hex src/bin/tests.rs:127:20

18 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
fn test_error_byte_writer() {
    let in_buf = b"\x8f\x02\x80\x68\x65\x6c\x6c\x6f\x0a\x03\x67\x6f\x6f\x64\x62\x79\x65\x0a";
    let mut output = Buffer::new(&[]);
    let mut writer = super::brotli_decompressor::DecompressorWriter::new(&mut output, 4096);
```
likely benign LLM, confidence 0.95 Test fixture of brotli-compressed bytes fed to a decompressor writer in an error-handling test.
Reasoning
The 18 hex escapes are a literal byte array passed to a brotli DecompressorWriter in a test function named test_error_byte_writer. The bytes decode to a brotli stream carrying the text 'hello' and 'goodbye', which is ordinary compression test data. The raw-pass encoding signal is a false positive on a test fixture.
info ~~warn~~ → info by review encoding-hex src/reader.rs:451:35

18 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
    // Output from this command:
    let compressed_with_extra = b"\x8f\x02\x80\x68\x65\x6c\x6c\x6f\x0a\x03\x67\x6f\x6f\x64\x62\x79\x65\x0a";
    // Make sure that read_to_string returns the data.
    let cursor = std::io::Cursor::new(compressed_with_extra);
```
likely benign LLM, confidence 0.95 Brotli-compressed test vector used to check that read_to_string handles extra trailing data.
Reasoning
The byte literal is a brotli-compressed sample ('hello' and 'goodbye' with trailing data) passed to a Cursor for a read_to_string test. The comment above it refers to the output of a command that produced the data, which is typical for a test vector. No execution or exfiltration pattern is present, so this is a legitimate fixture.

info long-line src/test.rs:809:1

line length 944 characters (raw pass, confidence 0.50)

      27, 250, 0, 64, 44, 11, 108, 247, 52, 24, 142, 163, 204, 142, 80, 252, 182, 120, 165, 79, 250, 13, 158, 3, 30, 234, 40, 250, 29, 20, 77, 120, 230, 200, 129, 115, 130, 14, 64, 215, 56, 237, 122, 86, 138, 52, 110, 119, 30, 215, 82, 74, 30, 171, 105, 88, 99, 31, 14, 167, 214, 226, 231, 246, 248, 42, 94, 190, 205, 22

info long-line src/test.rs:818:1

line length 1104 characters (raw pass, confidence 0.50)

  let expected: &[u8] = &[148, 100, 52, 4, 5, 6, 7, 214, 165, 116, 67, 18, 225, 176, 127, 78, 29, 235, 185, 135, 85, 35, 241, 191, 141, 91, 41, 247, 196, 145, 94, 43, 248, 197, 146, 95, 44, 249, 198, 146, 94, 42, 246, 194, 142, 90, 38, 242, 190, 138, 85, 32, 235, 182, 129, 76, 23, 226, 173, 120, 67, 13, 215, 161, 107,

info whitespace-anomaly src/writer.rs:20:1

file mixes tab and space indentation (1 tab-indented and 388 space-indented lines) (raw pass, confidence 0.40)

pub struct DecompressorWriterCustomAlloc<W: Write,
     BufferType : SliceWrapperMut<u8>,
     AllocU8 : Allocator<u8>,
     AllocU32 : Allocator<u32>,

info ~~warn~~ → info by review encoding-hex src/writer.rs:477:26

18 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)
```
    fn write_extra() {
        let contents = b"\x8f\x02\x80\x68\x65\x6c\x6c\x6f\x0a\x03\x67\x6f\x6f\x64\x62\x79\x65\x0a";
        let mut decoder = DecompressorWriter::new(Vec::new(), 0);
        let n = decoder.write(contents).unwrap();
```
likely benign LLM, confidence 0.95 Same brotli test vector used in a writer test that checks handling of extra data after the stream.
Reasoning
The same brotli byte sequence appears in a write_extra test that feeds it into a DecompressorWriter. This is a known compressed test input in a compression library, and the raw encoding signal only reflects the hex-escaped bytes, not any malicious behaviour.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o brotli-decompressor-6.1.1.crate 'https://static.crates.io/crates/brotli%2Ddecompressor/brotli%2Ddecompressor-6%2E1%2E1.crate'
printf '%s  %s\n' 28a996bd762f99a48a3aebaa662ff203cc4fb388706eff2e88e7cb459d013a62 brotli-decompressor-6.1.1.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf brotli-decompressor-6.1.1.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg