azure-core 1.41.0

Source: https://github.com/Azure/azure-sdk-for-python
Tag scanned: azure-core_1.41.0
Directory: sdk/core/azure-core (only this part of the repository was scanned)
Compared with: azure-core_1.40.0 (0 signals introduced since)
Files: 208 scanned, 12 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 16 info
Scan time: 11.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 14 of 14 warn and critical signals; 14 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:47

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload sdk/core/azure-core/azure/core/pipeline/transport/_aiohttp.py:468:42

file imports decoder module(s) codecs, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
                    zlib_mode = (16 + zlib.MAX_WBITS) if enc == "gzip" else -zlib.MAX_WBITS
                    self._decompressor = zlib.decompressobj(wbits=zlib_mode)
                chunk = self._decompressor.decompress(chunk)
            return chunk
```
likely benign LLM, confidence 0.90 Library code decompressing HTTP response bodies based on Content-Encoding.
Reasoning
Standard HTTP response decompression for gzip/deflate content-encoding using zlib with wbits set from the Content-Encoding header. This is normal library behavior, not an embedded payload being executed.
info ~~warn~~ → info by review decoder-decompress-payload sdk/core/azure-core/azure/core/utils/_pipeline_transport_rest_shared.py:410:24

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        zlib_mode = (16 + zlib.MAX_WBITS) if enc == "gzip" else -zlib.MAX_WBITS
        decompressor = zlib.decompressobj(wbits=zlib_mode)
        response._content = decompressor.decompress(response._content)
        response._decompressed_content = True
```
likely benign LLM, confidence 0.90 HTTP response content decompression in azure-core shared transport utilities.
Reasoning
Same pattern as the aiohttp transport: zlib decompression of HTTP response content according to Content-Encoding. Expected behavior for an HTTP client library.
info ~~critical~~ → info by review dynamic-execution sdk/core/azure-core/tests/async_tests/conftest.py:67:25

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
        # On linux, have to set shell=True
        child_process = subprocess.Popen(cmd, shell=True, preexec_fn=os.setsid, env=dict(os.environ))
    # Wait up to ~20s with backoff for Flask to start serving
    for delay in [0.5, 1, 1, 2, 2, 2, 4, 4, 4]:
```
likely benign LLM, confidence 0.85 Test fixture starting a local Flask server subprocess.
Reasoning
Test fixture launching a Flask test server with shell=True on Linux; the command is built locally by the test harness. Test infrastructure, not an attack, though shell=True with a variable command is worth a note.

info unicode-mixed-script sdk/core/azure-core/tests/async_tests/test_rest_http_response_async.py:267:32

identifier `鿰ꦑ` mixes scripts: Han + Other (in string/comment) (raw pass, confidence 0.40)

    response.encoding = "utf-16"
    assert response.text() == "鿰ꦑ" == response.content.decode(response.encoding)

    # assert latin-1 changes text decoding without changing encoding property

info ~~warn~~ → info by review payload-bytes-literal sdk/core/azure-core/tests/async_tests/test_universal_http_async.py:137:9

concatenated bytes literal contains 130 `\xNN` escapes (87% of content) — binary payload shape (ast pass, confidence 0.85)
```
        http_response,
        b"\x1f\x8b\x08\x00\x00\x00\x00\x00\x04\x00\x8d\x8d\xb1n\xc30\x0cD"
        b"\xff\x85s\x14HVlY\xda\x8av.\n4\x1d\x9a\x8d\xa1\xe5D\x80m\x01\x12="
        b"\x14A\xfe\xbd\x92\x81d\xceB\x1c\xef\xf8\x8e7\x08\x038\xf0\xa67Fj+"
```
likely benign LLM, confidence 0.85 Gzip-compressed fixture bytes for testing HTTP response decoding.
Reasoning
Bytes literal is a gzip stream (starts with \x1f\x8b) used as a mocked HTTP response body to test decompression. Test fixture data, legitimate.
info ~~warn~~ → info by review payload-bytes-literal sdk/core/azure-core/tests/async_tests/test_universal_http_async.py:168:9

concatenated bytes literal contains 115 `\xNN` escapes (86% of content) — binary payload shape (ast pass, confidence 0.85)
```
        http_response,
        b"\xff\x85s\x14HVlY\xda\x8av.\n4\x1d\x9a\x8d\xa1\xe5D\x80m\x01\x12="
        b"\x14A\xfe\xbd\x92\x81d\xceB\x1c\xef\xf8\x8e7\x08\x038\xf0\xa67Fj+"
        b"\x946\x9d8\x0c4\x08{\x96(\x94mzkh\x1cM/a\x07\x94<\xb2\x1f>\xca8\x86"
```
likely benign LLM, confidence 0.85 Additional gzip-compressed fixture bytes for decoding tests.
Reasoning
Continuation of the same gzip test fixture payload used to mock a compressed HTTP response. Legitimate test data.
info ~~critical~~ → info by review dynamic-execution sdk/core/azure-core/tests/conftest.py:82:25

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
        # On linux, have to set shell=True
        child_process = subprocess.Popen(cmd, shell=True, preexec_fn=os.setsid, env=dict(os.environ))
    # Wait up to ~20s with backoff for Flask to start serving
    for delay in [0.5, 1, 1, 2, 2, 2, 4, 4, 4]:
```
likely benign LLM, confidence 0.85 Test fixture starting a local Flask server subprocess.
Reasoning
Same test server launcher as the async conftest, starting Flask with shell=True and a locally constructed command. Test harness code.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_basic_transport.py:92:53

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                "x-ms-date": "Thu, 14 Jun 2018 16:46:54 GMT",
                "Authorization": "SharedKey account:G4jjBXA7LI/RnWKIOQ8i9xH4p76pAQ+4Fs4R1VxasaE=",  # fake key suppressed in credscan
                "Content-Length": "0",
            }
```
likely benign LLM, confidence 0.90 Fake Azure SharedKey authorization value in a unit test.
Reasoning
The string is a fake SharedKey Authorization header in a test, explicitly annotated as a fake key suppressed in credscan. Not a real credential or obfuscated payload.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_basic_transport.py:102:44

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        b"x-ms-date: Thu, 14 Jun 2018 16:46:54 GMT\r\n"
        b"Authorization: SharedKey account:G4jjBXA7LI/RnWKIOQ8i9xH4p76pAQ+4Fs4R1VxasaE=\r\n"  # fake key suppressed in credscan
        b"Content-Length: 0\r\n"
        b"\r\n"
```
likely benign LLM, confidence 0.90 Fake SharedKey authorization line in a test request fixture.
Reasoning
Same fake SharedKey header value in a raw HTTP request fixture, annotated as a fake key. Benign test data.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_rest_http_request.py:376:53

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                "x-ms-date": "Thu, 14 Jun 2018 16:46:54 GMT",
                "Authorization": "SharedKey account:G4jjBXA7LI/RnWKIOQ8i9xH4p76pAQ+4Fs4R1VxasaE=",  # fake key suppressed in credscan
                "Content-Length": "0",
            }
```
likely benign LLM, confidence 0.90 Fake SharedKey authorization value in a REST request test.
Reasoning
Duplicate of the fake, credscan-suppressed SharedKey test header. Benign test data.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_rest_http_request.py:388:52

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                b"x-ms-date: Thu, 14 Jun 2018 16:46:54 GMT\r\n"
                b"Authorization: SharedKey account:G4jjBXA7LI/RnWKIOQ8i9xH4p76pAQ+4Fs4R1VxasaE=\r\n"  # fake key suppressed in credscan
                b"Content-Length: 0\r\n"
                b"\r\n"
```
likely benign LLM, confidence 0.92 A fake SharedKey Authorization header value in a test request fixture.
Reasoning
The raw pass flagged a base64-like string in an Authorization SharedKey header inside a test fixture. The inline comment says the key is fake and suppressed in credscan, and the surrounding lines are ordinary HTTP header construction. This is a test value, not obfuscation or a credential.

info unicode-mixed-script sdk/core/azure-core/tests/test_rest_http_response.py:308:32

identifier `鿰ꦑ` mixes scripts: Han + Other (in string/comment) (raw pass, confidence 0.40)

    response.encoding = "utf-16"
    assert response.text() == "鿰ꦑ" == response.content.decode(response.encoding)

    # assert latin-1 changes text decoding without changing encoding property

info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_utils.py:162:163

base64-like blob (132 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
    headers = {
        "WWW-Authenticate": 'Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", error="insufficient_claims", claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ=="'
    }
```
likely benign LLM, confidence 0.93 A base64-encoded claims parameter in a test WWW-Authenticate header.
Reasoning
The flagged blob is the base64 'claims' parameter of a WWW-Authenticate challenge in a unit test for Azure CAE (insufficient_claims). It decodes to a small JSON object (access_token nbf/xms_caeerror). This is expected protocol test data, not a payload or hidden code.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_utils.py:171:13

base64-like blob (132 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
        get_challenge_parameter(headers, "Bearer", "claims")
        == "eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ=="
    )
```
likely benign LLM, confidence 0.93 Expected base64 claims value in an assertion of a challenge-parsing test.
Reasoning
The same base64 claims value is compared against the parser output in an assertion. It is test expectation data for a documented auth challenge format, with no execution or concealment involved.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_utils.py:193:253

base64-like blob (132 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
/authorize", error="insufficient_claims", claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ=="'
```
likely benign LLM, confidence 0.93 Repeated base64 claims fixture within another test's WWW-Authenticate string.
Reasoning
This is a repeated copy of the same base64 claims value embedded in a test header string for the CAE challenge scenario. It is fixture data that decodes to plain JSON, so it is not obfuscation.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_utils.py:202:13

base64-like blob (132 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
        get_challenge_parameter(headers, "Bearer", "claims")
        == "eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ=="
    )
```
likely benign LLM, confidence 0.93 Repeated expected base64 claims value in a challenge-parsing test assertion.
Reasoning
This is another assertion repeating the same base64 claims test vector. The context is a unit test comparing parsed challenge parameters, so the finding is a false positive from the raw base64 heuristic.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/Azure/azure-sdk-for-python azure-sdk-for-python && cd azure-sdk-for-python
git checkout azure-core_1.41.0
disclude scan --severity info --diff azure-core_1.40.0 sdk/core/azure-core