rustls-webpki 0.103.16

Source: https://github.com/rustls/webpki
Commit scanned: 8ecdcc76f56b (recorded by crates.io)
Compared with: c14836d8de33 (0 signals introduced since)
Files: 54 scanned, 408 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 4.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 09:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tests/generate.py:2253:9

`subprocess.run` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    if args.format:
        subprocess.run("cargo fmt", shell=True, check=True)
    if args.test:
        subprocess.run("cargo test", shell=True, check=True)
```
likely benign LLM, confidence 0.92 Runs the literal command `cargo fmt` through a shell when a flag is set.
Reasoning
shell=True is used only with a fixed literal string "cargo fmt", with no interpolated or external input. This is an ordinary build/test helper invoking a standard Rust tool, and nothing in the snippet suggests obfuscation or malicious intent.
info ~~warn~~ → info by review dynamic-execution tests/generate.py:2255:9

`subprocess.run` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    if args.test:
        subprocess.run("cargo test", shell=True, check=True)
```
likely benign LLM, confidence 0.92 Runs the literal command `cargo test` through a shell when a flag is set.
Reasoning
The command is the fixed literal "cargo test" run with shell=True and check=True. No variable input reaches the shell, and the code is in a tests helper, so this is a routine test-runner pattern.
info ~~warn~~ → info by review dynamic-execution third-party/chromium/data/verify_signed_data/ours/make-pss.py:54:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
if __name__ == '__main__':
    subprocess.check_call('openssl genrsa -out priv.pem 2048', shell = True)
    subprocess.check_call('openssl rsa -pubout -out pub.pem -in priv.pem', shell = True)
    subprocess.check_call('openssl asn1parse -inform pem -in pub.pem -out pub.der', shell = True)
```
likely benign LLM, confidence 0.93 Runs a literal `openssl genrsa` command to create test key material.
Reasoning
This is a `__main__` script that generates RSA test key material with fixed openssl commands. The shell=True arguments are hardcoded literals, and the file lives in Chromium's test-data tree, which is a legitimate use.
info ~~warn~~ → info by review dynamic-execution third-party/chromium/data/verify_signed_data/ours/make-pss.py:55:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    subprocess.check_call('openssl genrsa -out priv.pem 2048', shell = True)
    subprocess.check_call('openssl rsa -pubout -out pub.pem -in priv.pem', shell = True)
    subprocess.check_call('openssl asn1parse -inform pem -in pub.pem -out pub.der', shell = True)
```
likely benign LLM, confidence 0.93 Runs a literal `openssl rsa` command to export a public key for test data.
Reasoning
The shell=True call runs a fixed `openssl rsa` command to derive a public key from the generated private key. It is a hardcoded test-data generation step with no external input, consistent with the rest of the script.
info ~~warn~~ → info by review dynamic-execution third-party/chromium/data/verify_signed_data/ours/make-pss.py:56:5

`subprocess.check_call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    subprocess.check_call('openssl rsa -pubout -out pub.pem -in priv.pem', shell = True)
    subprocess.check_call('openssl asn1parse -inform pem -in pub.pem -out pub.der', shell = True)
    gen('rsa-pss-sha256-salt32.pem', TOP + 'src/data/alg-pss-sha256.der', 'sha256')
```
likely benign LLM, confidence 0.93 Runs a literal `openssl asn1parse` command to convert a public key to DER.
Reasoning
The shell=True call runs a fixed `openssl asn1parse` conversion to DER, and the following line is a regular helper call. The commands are literal test-generation steps in a vendored Chromium test-data script, not malicious.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rustls/webpki webpki && cd webpki
git checkout 8ecdcc76f56b68fda67a6adf7976f5eed5006a4c
disclude scan --severity info --diff c14836d8de33c0ad0ac7dcb28fe9aade20831a4d .