rustls 0.23.46

Source: https://github.com/rustls/rustls
Commit scanned: f04804fa1334 (recorded by crates.io)
Directory: rustls (only this part of the repository was scanned)
Compared with: 2976d90fd1c2 (0 signals introduced since)
Files: 127 scanned, 58 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 16 info
Scan time: 13.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 16 of 16 warn and critical signals; 16 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-17 00:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:99:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    fn check_sha256() {
        let secret = b"\x9b\xbe\x43\x6b\xa9\x40\xf0\x17\xb1\x76\x52\x84\x9a\x71\xdb\x35";
        let seed = b"\xa0\xba\x9f\x93\x6c\xda\x31\x18\x27\xa6\xf7\x96\xff\xd5\x19\x8c";
        let label = b"test label";
```
likely benign LLM, confidence 0.93 Byte-string literal holding a TLS PRF test secret for the SHA-256 check.
Reasoning
The hex escapes are fixed PRF test-vector secret bytes in a TLS 1.2 test function, consumed by a known-answer test against a testdata file. Test vectors like this are expected in a TLS library, and the raw-pass hex signal is a known false-positive pattern.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:100:22

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        let secret = b"\x9b\xbe\x43\x6b\xa9\x40\xf0\x17\xb1\x76\x52\x84\x9a\x71\xdb\x35";
        let seed = b"\xa0\xba\x9f\x93\x6c\xda\x31\x18\x27\xa6\xf7\x96\xff\xd5\x19\x8c";
        let label = b"test label";
        let expect = include_bytes!("../testdata/prf-result.1.bin");
```
likely benign LLM, confidence 0.93 Byte-string literal holding PRF seed bytes for a TLS 1.2 SHA-256 known-answer test.
Reasoning
Same test-vector seed and secret literals as the neighbouring finding, used with include_bytes! of a known-answer file. No execution or decoding of hidden payloads.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:117:24

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
    fn check_sha512() {
        let secret = b"\xb0\x32\x35\x23\xc1\x85\x35\x99\x58\x4d\x88\x56\x8b\xbb\x05\xeb";
        let seed = b"\xd4\x64\x0e\x12\xe4\xbc\xdb\xfb\x43\x7f\x03\xe6\xae\x41\x8e\xe5";
        let label = b"test label";
```
likely benign LLM, confidence 0.93 Byte-string literal holding a TLS PRF test secret for the SHA-512 check.
Reasoning
Fixed secret bytes for a SHA-512 PRF known-answer test. Hex escapes in a crypto test fixture are legitimate and the raw entropy signal is expected for key material in test data.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:118:22

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        let secret = b"\xb0\x32\x35\x23\xc1\x85\x35\x99\x58\x4d\x88\x56\x8b\xbb\x05\xeb";
        let seed = b"\xd4\x64\x0e\x12\xe4\xbc\xdb\xfb\x43\x7f\x03\xe6\xae\x41\x8e\xe5";
        let label = b"test label";
        let expect = include_bytes!("../testdata/prf-result.2.bin");
```
likely benign LLM, confidence 0.93 Byte-string literal holding PRF seed bytes for the SHA-512 known-answer test.
Reasoning
Companion seed literal for the SHA-512 known-answer test, referencing a checked-in testdata file. Consistent with a normal test fixture.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:135:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
    fn check_sha384() {
        let secret = b"\xb8\x0b\x73\x3d\x6c\xee\xfc\xdc\x71\x56\x6e\xa4\x8e\x55\x67\xdf";
        let seed = b"\xcd\x66\x5c\xf6\xa8\x44\x7d\xd6\xff\x8b\x27\x55\x5e\xdb\x74\x65";
        let label = b"test label";
```
likely benign LLM, confidence 0.93 Byte-string literal holding a TLS PRF test secret for the SHA-384 check.
Reasoning
Fixed secret bytes for a SHA-384 PRF known-answer test, a standard practice for validating a crypto implementation against published vectors.
info ~~warn~~ → info by review encoding-hex rustls/src/crypto/tls12.rs:136:22

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)
```
        let secret = b"\xb8\x0b\x73\x3d\x6c\xee\xfc\xdc\x71\x56\x6e\xa4\x8e\x55\x67\xdf";
        let seed = b"\xcd\x66\x5c\xf6\xa8\x44\x7d\xd6\xff\x8b\x27\x55\x5e\xdb\x74\x65";
        let label = b"test label";
        let expect = include_bytes!("../testdata/prf-result.3.bin");
```
likely benign LLM, confidence 0.93 Byte-string literal holding PRF seed bytes for the SHA-384 known-answer test.
Reasoning
Seed literal paired with the SHA-384 test secret and an expected-output testdata file. Ordinary known-answer test structure.
info ~~warn~~ → info by review encoding-hex rustls/src/msgs/message_test.rs:58:9

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
        \x16\x03\x01\x00\xeb\x01\x00\x00\xe7\x03\x03\xb6\x1f\xe4\x3a\x55\
        \x90\x3e\xc0\x28\x9c\x12\xe0\x5c\x84\xea\x90\x1b\xfb\x11\xfc\xbd\
        \x25\x55\xda\x9f\x51\x93\x1b\x8d\x92\x66\xfd\x00\x00\x2e\xc0\x2c\
        \xc0\x2b\xc0\x24\xc0\x23\xc0\x0a\xc0\x09\xcc\xa9\xc0\x30\xc0\x2f\
```
likely benign LLM, confidence 0.92 Continuation of a byte literal encoding a TLS ClientHello for a message parsing test.
Reasoning
The escapes encode a TLS ClientHello record (0x16 0x03 0x01 handshake header, cipher suite list) inside a test byte array for message parsing. This is protocol fixture data, not an obfuscated payload.
info ~~warn~~ → info by review encoding-hex rustls/src/msgs/message_test.rs:59:9

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
        \x90\x3e\xc0\x28\x9c\x12\xe0\x5c\x84\xea\x90\x1b\xfb\x11\xfc\xbd\
        \x25\x55\xda\x9f\x51\x93\x1b\x8d\x92\x66\xfd\x00\x00\x2e\xc0\x2c\
        \xc0\x2b\xc0\x24\xc0\x23\xc0\x0a\xc0\x09\xcc\xa9\xc0\x30\xc0\x2f\
        \xc0\x28\xc0\x27\xc0\x14\xc0\x13\xcc\xa8\x00\x9d\x00\x9c\x00\x3d\
```
likely benign LLM, confidence 0.92 Continuation of a TLS ClientHello byte literal used in a message test.
Reasoning
Further ClientHello bytes (cipher suites and extensions) in a parser test fixture. The raw hex signal is a false positive on structured binary test data.
info ~~warn~~ → info by review encoding-hex rustls/src/msgs/message_test.rs:69:9

16 consecutive `\xNN` escapes (entropy 3.5 bits/byte) (raw pass, confidence 0.65)
```
        \x32\x05\x68\x32\x2d\x31\x36\x05\x68\x32\x2d\x31\x35\x05\x68\x32\
        \x2d\x31\x34\x08\x73\x70\x64\x79\x2f\x33\x2e\x31\x06\x73\x70\x64\
        \x79\x2f\x33\x08\x68\x74\x74\x70\x2f\x31\x2e\x31\x00\x0b\x00\x02\
        \x01\x00\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x18\x00\x19";
```
likely benign LLM, confidence 0.92 Continuation of a ClientHello fixture containing ALPN protocol names and extensions.
Reasoning
The bytes spell ALPN strings (h2, http/1.1, spdy/3.1) and extension data within a ClientHello fixture. Recognisable protocol encoding in a test, not a dropper.
info ~~warn~~ → info by review encoding-hex rustls/src/msgs/message_test.rs:70:9

16 consecutive `\xNN` escapes (entropy 3.5 bits/byte) (raw pass, confidence 0.65)
```
        \x2d\x31\x34\x08\x73\x70\x64\x79\x2f\x33\x2e\x31\x06\x73\x70\x64\
        \x79\x2f\x33\x08\x68\x74\x74\x70\x2f\x31\x2e\x31\x00\x0b\x00\x02\
        \x01\x00\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x18\x00\x19";
    let mut rd = Reader::init(bytes);
```
likely benign LLM, confidence 0.92 Final bytes of a ClientHello test fixture passed to a parser reader.
Reasoning
Trailing extension bytes (supported groups, EC point formats) of the same ClientHello test fixture, fed to a Reader for parsing. Benign test data.
info ~~warn~~ → info by review encoding-hex rustls/tests/api.rs:8005:9

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (raw pass, confidence 0.65)
```
        \x16\x03\x01\x00\xc8\x01\x00\x00\xc4\x03\x03\xec\x12\xdd\x17\x64\
        \xa4\x39\xfd\x7e\x8c\x85\x46\xb8\x4d\x1e\xa0\x6e\xb3\xd7\xa0\x51\
        \xf0\x3c\xb8\x17\x47\x0d\x4c\x54\xc5\xdf\x72\x00\x00\x1c\xea\xea\
        \xc0\x2b\xc0\x2f\xc0\x2c\xc0\x30\xcc\xa9\xcc\xa8\xc0\x13\xc0\x14\
```
likely benign LLM, confidence 0.91 Continuation of a TLS ClientHello byte literal in an API integration test.
Reasoning
A TLS ClientHello record with cipher suite identifiers, embedded as a test byte literal in an integration test. Matches the legitimate protocol fixtures in the repository and has no execution or decoding path.
info ~~warn~~ → info by review encoding-hex rustls/tests/api.rs:8006:9

16 consecutive `\xNN` escapes (entropy 3.8 bits/byte) (raw pass, confidence 0.65)
```
        \xa4\x39\xfd\x7e\x8c\x85\x46\xb8\x4d\x1e\xa0\x6e\xb3\xd7\xa0\x51\
        \xf0\x3c\xb8\x17\x47\x0d\x4c\x54\xc5\xdf\x72\x00\x00\x1c\xea\xea\
        \xc0\x2b\xc0\x2f\xc0\x2c\xc0\x30\xcc\xa9\xcc\xa8\xc0\x13\xc0\x14\
        \x00\x9c\x00\x9d\x00\x2f\x00\x35\x00\x0a\x01\x00\x00\x7f\xda\xda\
```
likely benign LLM, confidence 0.93 Hard-coded TLS ClientHello bytes used as a test fixture.
Reasoning
The hex escapes form a TLS ClientHello byte sequence (cipher suite IDs such as 0xc02b, 0xc02f, and 0x009c, plus extension-like bytes) in a test file for a TLS library. Raw-pass hex runs in protocol test vectors are expected, and nothing here executes or decodes into a payload.
info ~~warn~~ → info by review encoding-hex rustls/tests/api.rs:8014:9

16 consecutive `\xNN` escapes (entropy 3.5 bits/byte) (raw pass, confidence 0.65)
```
        \x01\x00\x05\x00\x05\x01\x00\x00\x00\x00\x00\x12\x00\x00\x00\x10\
        \x00\x0e\x00\x0c\x02\x68\x32\x08\x68\x74\x74\x70\x2f\x31\x2e\x31\
        \x75\x50\x00\x00\x00\x0b\x00\x02\x01\x00\x00\x0a\x00\x0a\x00\x08\
        \x1a\x1a\x00\x1d\x00\x17\x00\x18\x1a\x1a\x00\x01\x00\
```
likely benign LLM, confidence 0.93 Hard-coded TLS handshake extension bytes in a test fixture.
Reasoning
The sequence contains TLS record and extension bytes, including the ALPN string 'h2' and 'http/1.1', consistent with a serialized handshake message in a protocol test. This is a legitimate test vector with no execution or obfuscated payload behavior.
info ~~warn~~ → info by review encoding-base64 rustls/tests/ech.rs:119:6

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
const BASE64_ECHCONFIG_LIST_LOCALHOST: &str =
    "AED+DQA8AAAgACAxoIJyV36iDlfFRmqE+ho2PxXE0EISPfUUJYKCy6T8VwAIAAEAAQABAAOACWxvY2FsaG9zdAAA";

// Two EchConfigs, both with server-name "cloudflare-esni.com".
```
likely benign LLM, confidence 0.94 Base64 ECHConfigList test vector for localhost.
Reasoning
The constant is a base64-encoded ECHConfigList, which is the standard wire format for Encrypted Client Hello. Its name and the comment about server-name 'cloudflare-esni.com' show it is a protocol test vector, and it is only parsed in tests.
info ~~warn~~ → info by review encoding-base64 rustls/tests/ech.rs:122:41

base64-like blob (236 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
```
const BASE64_ECHCONFIG_LIST_CF: &str = "AK3+DQBCwwAgACAJ9T5U4FeM6631r2bvAuGtmEd8zQaoTkFAtArTcMl/XQAEAAEAASUTY2xvdWRmbGFyZS1lc25pLmNvbQAA/g0AYwMAEABBBGGbUlGLuGRorUeFwmrgHImkrh9uxoPrnFKpS5bQvnc5grfMS3PvymQ2FYL02WQi1ZzZJg5OsYYdzlaGYnEoJNsABAABAAEqE2Nsb3VkZmxhcmUtZXNuaS5jb20AAA==";
```
likely benign LLM, confidence 0.94 Base64 ECHConfigList test vector for Cloudflare ESNI.
Reasoning
The constant is a base64-encoded ECH config list for Cloudflare's ESNI test endpoint, named BASE64_ECHCONFIG_LIST_CF. It is a static protocol fixture, and the high-entropy content is expected for public-key material.
info ~~warn~~ → info by review encoding-base64 rustls/tests/ech.rs:125:55

base64-like blob (352 bytes, compression ratio 0.77) (raw pass, confidence 0.60)
```
t BASE64_ECHCONFIG_LIST_WITH_UNSUPPORTED: &str = "AQW63QAFBQQDAgH+DQBmAAAQAEEE5itp4r9ln5e+Lx4NlIpM1Zdrt6keDUb73ampHp3culoB59aXqAoY+cPEox5W4nyDSNsWGhz1HX7xlC1Lz3IiwQAMAAEAAQABAAIAAQADQA5wdWJsaWMuZXhhbXBsZQAA/g0APQAAIAAgfWYWFXMCFK7ucFMzZvNqYJ6tZcDCCOYjIjRqtbzY3hwABBERIiJADnB1YmxpYy5leGFtcGxlAAD+DQBNAAAgACCFvWoDJ3wlQntS4m
```
likely benign LLM, confidence 0.93 Base64 ECH config list test vector with an unsupported version.
Reasoning
The constant is a base64 ECHConfigList containing an unsupported-version entry, used to test rejection handling. It is a named test vector with no execution path, and the raw-pass blob signal is a known false positive for encoded test data.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rustls/rustls rustls && cd rustls
git checkout f04804fa13341a9b1dc02b5d1dd8a746f2c4b7fb
disclude scan --severity info --diff 2976d90fd1c2db6b518700dd101b714069cfcb17 rustls