azure-core 1.41.0

Source: https://github.com/Azure/azure-sdk-for-python
Tag scanned: azure-core_1.41.0
Directory: sdk/core/azure-core (only this part of the repository was scanned)
Compared with: azure-core_1.40.0 (0 signals introduced since)
Files: 208 scanned, 12 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 16 info
Scan time: 12.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 14 of 14 warn and critical signals; 14 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 05:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload sdk/core/azure-core/azure/core/pipeline/transport/_aiohttp.py:468:42

file imports decoder module(s) codecs, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
                    zlib_mode = (16 + zlib.MAX_WBITS) if enc == "gzip" else -zlib.MAX_WBITS
                    self._decompressor = zlib.decompressobj(wbits=zlib_mode)
                chunk = self._decompressor.decompress(chunk)
            return chunk
```
likely benign LLM, confidence 0.93 Streaming HTTP response decompression in the aiohttp transport.
Reasoning
The code decompresses an HTTP response body using zlib with wbits chosen from the Content-Encoding header (gzip or deflate). This is standard HTTP content decoding, not a hidden payload.
info ~~warn~~ → info by review decoder-decompress-payload sdk/core/azure-core/azure/core/utils/_pipeline_transport_rest_shared.py:410:24

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        zlib_mode = (16 + zlib.MAX_WBITS) if enc == "gzip" else -zlib.MAX_WBITS
        decompressor = zlib.decompressobj(wbits=zlib_mode)
        response._content = decompressor.decompress(response._content)
        response._decompressed_content = True
```
likely benign LLM, confidence 0.93 Decompresses a response body according to its Content-Encoding header.
Reasoning
Same pattern as the aiohttp transport: zlib decompression of a response body keyed on the Content-Encoding header. This is normal HTTP handling in an SDK.
info ~~critical~~ → info by review dynamic-execution sdk/core/azure-core/tests/async_tests/conftest.py:67:25

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
        # On linux, have to set shell=True
        child_process = subprocess.Popen(cmd, shell=True, preexec_fn=os.setsid, env=dict(os.environ))
    # Wait up to ~20s with backoff for Flask to start serving
    for delay in [0.5, 1, 1, 2, 2, 2, 4, 4, 4]:
```
likely benign LLM, confidence 0.85 Test fixture that starts a Flask server subprocess.
Reasoning
A test fixture launches a local Flask server with shell=True so it can run a command built by the test harness. The command is test-controlled and nothing suggests attacker input reaches it.

info unicode-mixed-script sdk/core/azure-core/tests/async_tests/test_rest_http_response_async.py:267:32

identifier `鿰ꦑ` mixes scripts: Han + Other (in string/comment) (raw pass, confidence 0.40)

    response.encoding = "utf-16"
    assert response.text() == "鿰ꦑ" == response.content.decode(response.encoding)

    # assert latin-1 changes text decoding without changing encoding property

info ~~warn~~ → info by review payload-bytes-literal sdk/core/azure-core/tests/async_tests/test_universal_http_async.py:137:9

concatenated bytes literal contains 130 `\xNN` escapes (87% of content) — binary payload shape (ast pass, confidence 0.85)
```
        http_response,
        b"\x1f\x8b\x08\x00\x00\x00\x00\x00\x04\x00\x8d\x8d\xb1n\xc30\x0cD"
        b"\xff\x85s\x14HVlY\xda\x8av.\n4\x1d\x9a\x8d\xa1\xe5D\x80m\x01\x12="
        b"\x14A\xfe\xbd\x92\x81d\xceB\x1c\xef\xf8\x8e7\x08\x038\xf0\xa67Fj+"
```
likely benign LLM, confidence 0.90 Gzip-compressed response body embedded as a test fixture.
Reasoning
The bytes literal begins with the gzip magic \x1f\x8b and encodes a gzip-compressed HTTP response body. Test fixtures commonly embed such data to exercise decompression paths.
info ~~warn~~ → info by review payload-bytes-literal sdk/core/azure-core/tests/async_tests/test_universal_http_async.py:168:9

concatenated bytes literal contains 115 `\xNN` escapes (86% of content) — binary payload shape (ast pass, confidence 0.85)
```
        http_response,
        b"\xff\x85s\x14HVlY\xda\x8av.\n4\x1d\x9a\x8d\xa1\xe5D\x80m\x01\x12="
        b"\x14A\xfe\xbd\x92\x81d\xceB\x1c\xef\xf8\x8e7\x08\x038\xf0\xa67Fj+"
        b"\x946\x9d8\x0c4\x08{\x96(\x94mzkh\x1cM/a\x07\x94<\xb2\x1f>\xca8\x86"
```
likely benign LLM, confidence 0.90 Further chunk of a gzip-compressed test response fixture.
Reasoning
A continuation of the same gzip-compressed test response fixture. It is test data for decompression handling, not a payload being executed.
info ~~critical~~ → info by review dynamic-execution sdk/core/azure-core/tests/conftest.py:82:25

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
        # On linux, have to set shell=True
        child_process = subprocess.Popen(cmd, shell=True, preexec_fn=os.setsid, env=dict(os.environ))
    # Wait up to ~20s with backoff for Flask to start serving
    for delay in [0.5, 1, 1, 2, 2, 2, 4, 4, 4]:
```
likely benign LLM, confidence 0.85 Test fixture that starts a Flask server subprocess.
Reasoning
Same test harness pattern as the async conftest: a local Flask server is started with shell=True using a test-controlled command.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_basic_transport.py:92:53

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                "x-ms-date": "Thu, 14 Jun 2018 16:46:54 GMT",
                "Authorization": "SharedKey account:G4jjBXA7LI/RnWKIOQ8i9xH4p76pAQ+4Fs4R1VxasaE=",  # fake key suppressed in credscan
                "Content-Length": "0",
            }
```
likely benign LLM, confidence 0.92 Fake SharedKey authorization value in a transport test.
Reasoning
The base64-like value is a placeholder SharedKey credential in a test request. The line is explicitly annotated as a fake key suppressed in credscan.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_basic_transport.py:102:44

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        b"x-ms-date: Thu, 14 Jun 2018 16:46:54 GMT\r\n"
        b"Authorization: SharedKey account:G4jjBXA7LI/RnWKIOQ8i9xH4p76pAQ+4Fs4R1VxasaE=\r\n"  # fake key suppressed in credscan
        b"Content-Length: 0\r\n"
        b"\r\n"
```
likely benign LLM, confidence 0.92 Fake SharedKey authorization header in a transport test.
Reasoning
The same placeholder SharedKey credential appears in a raw bytes request fixture and is annotated as fake for credscan.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_rest_http_request.py:376:53

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                "x-ms-date": "Thu, 14 Jun 2018 16:46:54 GMT",
                "Authorization": "SharedKey account:G4jjBXA7LI/RnWKIOQ8i9xH4p76pAQ+4Fs4R1VxasaE=",  # fake key suppressed in credscan
                "Content-Length": "0",
            }
```
likely benign LLM, confidence 0.92 Fake SharedKey authorization value in a REST request test.
Reasoning
The same annotated placeholder SharedKey value appears in a REST request test. It is a fake credential, not a live secret.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_rest_http_request.py:388:52

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                b"x-ms-date: Thu, 14 Jun 2018 16:46:54 GMT\r\n"
                b"Authorization: SharedKey account:G4jjBXA7LI/RnWKIOQ8i9xH4p76pAQ+4Fs4R1VxasaE=\r\n"  # fake key suppressed in credscan
                b"Content-Length: 0\r\n"
                b"\r\n"
```
likely benign LLM, confidence 0.92 Fake SharedKey authorization header in a REST request test.
Reasoning
This is the same annotated placeholder SharedKey header in a bytes fixture for a REST request test.

info unicode-mixed-script sdk/core/azure-core/tests/test_rest_http_response.py:308:32

identifier `鿰ꦑ` mixes scripts: Han + Other (in string/comment) (raw pass, confidence 0.40)

    response.encoding = "utf-16"
    assert response.text() == "鿰ꦑ" == response.content.decode(response.encoding)

    # assert latin-1 changes text decoding without changing encoding property

info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_utils.py:162:163

base64-like blob (132 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
    headers = {
        "WWW-Authenticate": 'Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", error="insufficient_claims", claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ=="'
    }
```
likely benign LLM, confidence 0.93 Base64url-encoded claims value in a WWW-Authenticate test header.
Reasoning
The base64-like segment is a claims parameter in an OAuth WWW-Authenticate challenge, which is a standard encoded JSON structure in auth error responses. It is test data for parsing those headers.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_utils.py:171:13

base64-like blob (132 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
        get_challenge_parameter(headers, "Bearer", "claims")
        == "eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ=="
    )
```
likely benign LLM, confidence 0.93 Base64-encoded OAuth claims JSON used as an expected value in a unit test.
Reasoning
The raw pass flagged a base64 string in a test assertion. It decodes to a JSON claims object (access_token with nbf and xms_caeerror values), which is the expected OAuth claims-challenge fixture for the test. The file is a test and the blob is plain data with no execution or hidden payload. This is a legitimate test fixture, and the raw pass is known to be noisy.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_utils.py:193:253

base64-like blob (132 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
/authorize", error="insufficient_claims", claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ=="'
```
likely benign LLM, confidence 0.93 Base64 OAuth claims parameter embedded in a test's WWW-Authenticate header string.
Reasoning
The same base64 claims blob appears as a claims parameter inside a WWW-Authenticate header string in a test. It decodes to the same benign JSON claims fixture. No code execution, decoding pipeline, or concealed behavior is present, so this is a normal test value.
info ~~warn~~ → info by review encoding-base64 sdk/core/azure-core/tests/test_utils.py:202:13

base64-like blob (132 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
        get_challenge_parameter(headers, "Bearer", "claims")
        == "eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzI2MDc3NTk1In0sInhtc19jYWVlcnJvciI6eyJ2YWx1ZSI6IjEwMDEyIn19fQ=="
    )
```
likely benign LLM, confidence 0.93 Repeated base64-encoded OAuth claims JSON used as an expected value in a unit test.
Reasoning
This is a duplicate of the first finding: the identical base64 claims blob is used as an expected value in another assertion in the test file. It decodes to a benign claims JSON fixture and shows no sign of obfuscation or malicious intent.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/Azure/azure-sdk-for-python azure-sdk-for-python && cd azure-sdk-for-python
git checkout azure-core_1.41.0
disclude scan --severity info --diff azure-core_1.40.0 sdk/core/azure-core