PyPI / boto3 / 1.43.116

boto3 1.43.116

Source

https://github.com/boto/boto3

Tag scanned

1.43.116

Compared with

1.43.115 (0 signals introduced since)

Files

209 scanned, 30 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

4.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-21 19:58

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review long-line docs/source/_templates/page.html:231:1

   line length 2058 characters (raw pass, confidence 0.65)

                     <path fill="currentColor" d="M39.2,391.3c-4.2,0.6-7.1,4.4-6.5,8.5c0.4,3,2.6,5.5,5.5,6.3 c0,0,18.5,6.1,50,8.7c25.3,2.1,54-1.8,54-1.8c4.2-0.1,7.5-3.6,7.4-7.8c-0.1-4.2-3.6-7.5-7.8-7.4c-0.5,0-1,0.1-1.5,0.2 c0,0-28.1,3.5-50.9,1.6c-30.1-2.4-46.5-7.9-46.5-7.9C41.7,391.3,40.4,391.1,39.2,391.3z M39.2,353.6c-4.

   dismissed LLM, confidence 0.97 Inline SVG path data for an icon in a Sphinx documentation template.

   Reasoning

   A 2058-character line containing SVG path data in an HTML template is a typical inlined icon or graphic. Long lines of path coordinates are common in generated SVG and carry no obfuscation or malicious payload; the raw pass has a high false-positive rate for this pattern.

2. info long-line docs/source/_templates/page.html:239:1

   line length 626 characters (raw pass, confidence 0.50)

                     <path fill-rule="evenodd" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1

3. info warn → info by review dynamic-execution scripts/new-change:123:13

   `subprocess.Popen` called with `shell=True` and a literal command (ast pass, confidence 0.70)

           editor = env.get('VISUAL', env.get('EDITOR', 'vim'))
           p = subprocess.Popen(f'{editor} {f.name}', shell=True)
           p.communicate()
           with open(f.name) as f:

   likely benign LLM, confidence 0.85 Helper script launches the user's editor via a shell command built from EDITOR/VISUAL and a temp filename.

   Reasoning

   The shell=True call runs an f-string built from the VISUAL/EDITOR environment variables and a temp file name. This is a developer helper that opens an editor, so the command is user-controlled from the local environment rather than attacker-supplied. The shell=True usage with an interpolated filename is a real quoting/injection hazard, but it is a legitimate pattern for launching an editor and does not show malicious intent.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/boto/boto3 boto3 && cd boto3
git checkout 1.43.116
disclude scan --severity info --diff 1.43.115 .