rustls-webpki 0.103.15

Source: https://github.com/rustls/webpki
Commit scanned: c14836d8de33 (recorded by crates.io)
Compared with: 14cbaa18eaac (0 signals introduced since)
Files: 54 scanned, 400 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 3.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 21:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tests/generate.py:2253:9

`subprocess.run` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    if args.format:
        subprocess.run("cargo fmt", shell=True, check=True)
    if args.test:
        subprocess.run("cargo test", shell=True, check=True)
```
likely benign LLM, confidence 0.90 Developer helper runs literal 'cargo fmt' via shell when a flag is set.
Reasoning
subprocess.run with shell=True but a fixed literal command (cargo fmt) under a CLI flag check. No external input is interpolated; this is a normal developer build/test helper script.
info ~~warn~~ → info by review dynamic-execution tests/generate.py:2255:9

`subprocess.run` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    if args.test:
        subprocess.run("cargo test", shell=True, check=True)
```
likely benign LLM, confidence 0.90 Developer helper runs literal 'cargo test' via shell when a flag is set.
Reasoning
Same pattern: a fixed literal 'cargo test' shell command gated by an argparse flag. No untrusted input reaches the command string.
info ~~warn~~ → info by review dynamic-execution third-party/chromium/data/verify_signed_data/ours/make-pss.py:54:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
if __name__ == '__main__':
    subprocess.check_call('openssl genrsa -out priv.pem 2048', shell = True)
    subprocess.check_call('openssl rsa -pubout -out pub.pem -in priv.pem', shell = True)
    subprocess.check_call('openssl asn1parse -inform pem -in pub.pem -out pub.der', shell = True)
```
likely benign LLM, confidence 0.92 Test-vector generator runs fixed openssl key generation command.
Reasoning
Test-data generator in a vendored Chromium tree invoking openssl with fixed literal arguments under __main__. Shell=True is unnecessary but the command is static and benign.
info ~~warn~~ → info by review dynamic-execution third-party/chromium/data/verify_signed_data/ours/make-pss.py:55:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    subprocess.check_call('openssl genrsa -out priv.pem 2048', shell = True)
    subprocess.check_call('openssl rsa -pubout -out pub.pem -in priv.pem', shell = True)
    subprocess.check_call('openssl asn1parse -inform pem -in pub.pem -out pub.der', shell = True)
```
likely benign LLM, confidence 0.92 Test-vector generator runs fixed openssl RSA public key export.
Reasoning
Fixed literal openssl rsa export command in a vendored test-data generator; no external input involved.
info ~~warn~~ → info by review dynamic-execution third-party/chromium/data/verify_signed_data/ours/make-pss.py:56:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    subprocess.check_call('openssl rsa -pubout -out pub.pem -in priv.pem', shell = True)
    subprocess.check_call('openssl asn1parse -inform pem -in pub.pem -out pub.der', shell = True)
    gen('rsa-pss-sha256-salt32.pem', TOP + 'src/data/alg-pss-sha256.der', 'sha256')
```
likely benign LLM, confidence 0.92 Test-vector generator runs fixed openssl asn1parse command.
Reasoning
Fixed literal openssl asn1parse command in a vendored test-data generator; benign build-time tooling.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rustls/webpki webpki && cd webpki
git checkout c14836d8de33c0ad0ac7dcb28fe9aade20831a4d
disclude scan --severity info --diff 14cbaa18eaacb2ad4110206b7d02c1ad08aabb42 .