disclude.io

crates.io / combine / 4.6.9

combine 4.6.9

Source
https://github.com/Marwes/combine
Tag scanned
v4.6.9
Compared with
v4.6.8 (0 signals introduced since)
Files
42 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 4 info
Scan time
4.4 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-15 13:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info long-line benches/http-requests.txt:332:1

    line length 573 characters (raw pass, confidence 0.50)

    GET /__utm.gif?utmwv=5.5.1&utms=1&utmn=720496082&utmhn=www.reddit.com&utme=8(site*srpath*usertype*uitype)9(%20reddit.com*%20reddit.com-GET_listing*guest*web)11(3!2)&utmcs=UTF-8&utmsr=2560x1600&utmvp=1288x792&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=13.0%20r0&utmdt=reddit%3A%20the%20front%20page%20of%20the%20internet&utmh
  2. info long-line benches/http-requests.txt:359:1

    line length 620 characters (raw pass, confidence 0.50)

    GET /__utm.gif?utmwv=5.5.1&utms=2&utmn=1493472678&utmhn=www.reddit.com&utmt=event&utme=5(AdBlock*enabled*false)(0)8(site*srpath*usertype*uitype)9(%20reddit.com*%20reddit.com-GET_listing*guest*web)11(3!2)&utmcs=UTF-8&utmsr=2560x1600&utmvp=1288x792&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=13.0%20r0&utmdt=reddit%3A%20the%20
  3. info warn → info by review encoding-base64 benches/http-requests.txt:440:12

    base64-like blob (404 bytes, compression ratio 0.76) (raw pass, confidence 0.60)

    GET /i.gif?e=eyJhdiI6NjIzNTcsImF0Ijo1LCJjbSI6MTE2MzUxLCJjaCI6Nzk4NCwiY3IiOjMzNzAxNSwiZGkiOiI4NmI2Y2UzYWM5NDM0MjhkOTk2ZTg4MjYwZDE5ZTE1YyIsImRtIjoxLCJmYyI6NDE2MTI4LCJmbCI6MjEwNDY0LCJrdyI6Ii1yZWRkaXQuY29tIiwibWsiOiItcmVkZGl0LmNvbSIsIm53Ijo1MTQ2LCJwYyI6MCwicHIiOjIwMzYyLCJydCI6MSwicmYiOiJodHRwOi8vd3d3LnJlZGRpdC5jb20vIiwic3Q
    likely benign LLM, confidence 0.93 A captured reddit analytics pixel request in a benchmark fixture, with a base64-encoded telemetry query parameter.
    Reasoning

    This is a recorded HTTP request line in a benchmark fixture file (.txt under benches/). The base64 payload is a URL query parameter for an analytics tracking pixel (/i.gif) and decodes to JSON-like telemetry fields such as referrer and keyword. It is ordinary captured traffic, not code, and the raw-pass base64 signal is a known false-positive pattern for encoded query strings.

  4. info warn → info by review encoding-base64 benches/http-requests.txt:478:12

    base64-like blob (404 bytes, compression ratio 0.76) (raw pass, confidence 0.60)

    GET /i.gif?e=eyJhdiI6NjIzNTcsImF0Ijo4LCJjbSI6MTE2MzUxLCJjaCI6Nzk4NCwiY3IiOjMzNzAxOCwiZGkiOiI3OTdlZjU3OWQ5NjE0ODdiODYyMGMyMGJkOTE4YzNiMSIsImRtIjoxLCJmYyI6NDE2MTMxLCJmbCI6MjEwNDY0LCJrdyI6Ii1yZWRkaXQuY29tIiwibWsiOiItcmVkZGl0LmNvbSIsIm53Ijo1MTQ2LCJwYyI6MCwicHIiOjIwMzYyLCJydCI6MSwicmYiOiJodHRwOi8vd3d3LnJlZGRpdC5jb20vIiwic3Q
    likely benign LLM, confidence 0.93 Another captured reddit analytics pixel request in the benchmark fixture, carrying base64 telemetry in its query string.
    Reasoning

    Same situation as the sibling finding: a logged GET request to an analytics pixel inside a benchmark text fixture. The base64 query value encodes tracking telemetry (ids, referrer, counters). It is data in a request log, not executable or obfuscated code, and the raw-pass signal here is a false positive.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/Marwes/combine combine && cd combine
git checkout v4.6.9
disclude scan --severity info --diff v4.6.8 .