botocore 1.43.113

Source: https://github.com/boto/botocore
Tag scanned: 1.43.113
Compared with: 1.43.112 (0 signals introduced since)
Files: 331 scanned, 3148 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 30 info
Scan time: 28.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 30 of 30 warn and critical signals; 30 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-import botocore/vendored/six.py:87:5

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    """Import module, returning the module after the last dot."""
    __import__(name)
    return sys.modules[name]
```
likely benign LLM, confidence 0.90 Vendored six library helper that dynamically imports a module by name.
Reasoning
This is the standard import helper in the vendored six compatibility library. It calls __import__ on a caller-supplied module name and returns sys.modules, which is the expected pattern for a dynamic-import utility. No payload or obfuscation is visible.
info ~~critical~~ → info by review frame-introspection botocore/vendored/six.py:728:21

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
        if _globs_ is None:
            frame = sys._getframe(1)
            _globs_ = frame.f_globals
            if _locs_ is None:
```
likely benign LLM, confidence 0.90 Vendored six code reads the caller's frame globals to set up module state.
Reasoning
This is six's lazy-module code, which reads the caller's globals via sys._getframe(1) to populate the module namespace. The anti-analysis label comes from generic co-occurrence in a large vendored file, not from anything in this snippet.
info ~~warn~~ → info by review dynamic-execution scripts/new-change:123:13

`subprocess.Popen` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        editor = env.get('VISUAL', env.get('EDITOR', 'vim'))
        p = subprocess.Popen(f'{editor} {f.name}', shell=True)
        p.communicate()
        with open(f.name) as f:
```
likely benign LLM, confidence 0.75 Developer script launches the user's editor via a shell command to edit a temp file.
Reasoning
The shell=True call runs an editor taken from the VISUAL/EDITOR environment variables, followed by a temp file name. This is a common and somewhat unsafe editor-launch idiom, but the command comes from the user's own environment and there is no remote input or encoded payload.
info ~~warn~~ → info by review decoder-decompress-payload tests/functional/test_compress.py:132:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        serialized_body = f"{additional_params}&{serialized_params}"
        actual_body = gzip.decompress(http_stubber.requests[0].body)
        assert serialized_body.encode('utf-8') == actual_body
```
likely benign LLM, confidence 0.90 Test decompresses a gzip request body to assert on its contents.
Reasoning
This is a functional test that gunzips a recorded HTTP request body in order to compare it against the expected serialized body. Decompression here only checks test output and is not an embedded or hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:230:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                "x-amz-request-algorithm": "SHA256",
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw=",
            },
        ),
```
dismissed LLM, confidence 0.95 Base64 SHA256 checksum string used as expected header value in an HTTP checksum test.
Reasoning
The value is a base64-encoded SHA256 checksum that appears as an expected x-amz-checksum header in a test fixture. This is ordinary test data, and the raw base64 heuristic has a high false-positive rate here.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:238:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
                "x-amz-request-algorithm": "SHA512",
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw==",
            },
        ),
```
dismissed LLM, confidence 0.95 Base64 SHA512 checksum string used as expected header value in a test fixture.
Reasoning
The value is a base64-encoded SHA512 checksum used as an expected header in a test fixture. It is legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:357:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw="
            },
        ),
```
dismissed LLM, confidence 0.95 Repeated base64 SHA256 checksum literal in a parametrized checksum test.
Reasoning
This is the same SHA256 checksum literal as elsewhere in the test file, used as a parametrized expected header value. It is benign test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:369:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw=="
            },
        ),
```
dismissed LLM, confidence 0.95 Repeated base64 SHA512 checksum literal in a parametrized checksum test.
Reasoning
This is the same SHA512 checksum literal in a parametrized test expectation. It is benign test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:478:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw="
            },
        ),
```
dismissed LLM, confidence 0.95 Repeated base64 SHA256 checksum literal in a test fixture.
Reasoning
This is a repeated SHA256 checksum literal in a test fixture, matching the known expected checksum for the test body. It is benign.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:485:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw=="
            },
        ),
```
dismissed LLM, confidence 0.95 Repeated base64 SHA512 checksum literal in a test fixture.
Reasoning
This is a repeated SHA512 checksum literal in a test fixture. It is benign.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:594:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {"x-amz-checksum-sha256": "bm90LWEtY2hlY2tzdW0="},
            "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw=",
        ),
        (
```
dismissed LLM, confidence 0.95 Expected SHA256 checksum literal in a parametrized checksum-mismatch test case.
Reasoning
The snippet contains an expected SHA256 checksum literal in a parametrized test case, next to a plain-text 'not-a-checksum' value. This is test data, not a hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:600:14

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {"x-amz-checksum-sha512": "bm90LWEtY2hlY2tzdW0="},
            "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw==",
        ),
    ]
```
dismissed LLM, confidence 0.95 Expected SHA512 checksum literal in a parametrized checksum-mismatch test case.
Reasoning
The snippet contains an expected SHA512 checksum literal in a parametrized test case, next to a base64 'not-a-checksum' value. It is benign test data.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/aws4_testsuite/post-sts-token/readme.txt:15:1

base64-like blob (336 bytes, compression ratio 0.85) (raw pass, confidence 0.60)
```
AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabI
```
dismissed LLM, confidence 0.92 A base64-looking example session token in a botocore aws4 test-suite readme.
Reasoning
The blob is the AWS documentation example STS session token from the aws4 test suite, a public sample value rather than a real credential or encoded payload. The readme is a test fixture description, so the base64 match is a false positive from a raw byte-pattern pass.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:217:32

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            result,
            ('Foo=%E2%9C%93', 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q='),
        )
```
dismissed LLM, confidence 0.93 An expected base64 HMAC signature constant in a SigV2 signer test.
Reasoning
The value is an expected HMAC-SHA256 signature string in a signer unit test, compared against computed output. Base64 is the normal output format for signatures, so this is a legitimate test vector.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:231:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            request.data['Signature'],
            'Tiecw+t51tok4dTT8B4bg47zxHEM/KcD55f2/x6K22o=',
        )
        self.assertEqual(request.data['SignatureMethod'], 'HmacSHA256')
```
dismissed LLM, confidence 0.93 An expected base64 signature asserted in a signer test.
Reasoning
This is an expected Signature value asserted against request data in a signer unit test. It is a legitimate test vector with no obfuscation or malicious behaviour.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:243:27

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            'Foo': '\u2713',
            'Signature': 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q=',
        }
        result = self.signer.calc_signature(request, params)
```
dismissed LLM, confidence 0.93 A fixed expected signature literal in a signer unit test.
Reasoning
The base64 value is an expected signature fixture in a signer test that compares calc_signature output. Signature strings like this are normal in test suites.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:248:32

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            result,
            ('Foo=%E2%9C%93', 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q='),
        )
```
dismissed LLM, confidence 0.93 An expected base64 signature tuple in a signer test.
Reasoning
The same expected signature constant appears in a signer test assertion. It is a fixed test vector for HMAC output.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:262:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            request.params['Signature'],
            'Un97klqZCONP65bA1+Iv4H3AcB2I40I4DBvw5ZERFPw=',
        )
        self.assertEqual(request.params['SignatureMethod'], 'HmacSHA256')
```
dismissed LLM, confidence 0.93 A base64 expected signature in a signer test assertion.
Reasoning
This is an expected signature value compared against request parameters in a test. No execution or hiding of code is involved.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:294:18

base64-like blob (54 bytes, compression ratio 1.20) (raw pass, confidence 0.60)
```
                'AWS3-HTTPS AWSAccessKeyId=access_key,Algorithm=HmacSHA256,'
                'Signature=M245fo86nVKI8rLpH4HgWs841sBTUKuwciiTpjMDgPs='
            ),
        )
```
dismissed LLM, confidence 0.92 An expected base64 signature inside an Authorization header string in a test.
Reasoning
The literal is an expected Authorization header signature in a signer test. It is a deterministic test vector, not an encoded payload.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_auth_bearer.py:30:19

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
        "headers": {},
        "token": "eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE=",
        "expectedHeaders": {
            "Authorization": "Bearer eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE="
```
likely benign LLM, confidence 0.90 A placeholder bearer token in an auth unit test fixture.
Reasoning
The token decodes to the plain text "you're not supposed to decode this!", a joke placeholder used as a bearer token fixture. It is a test value with no hidden behaviour.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_auth_bearer.py:32:38

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
        "expectedHeaders": {
            "Authorization": "Bearer eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE="
        },
    },
```
likely benign LLM, confidence 0.90 The expected Bearer header value matching the placeholder test token.
Reasoning
This is the expected Authorization header matching the same placeholder token in the bearer auth test. It is a fixture, not a dropper or obfuscated payload.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_compress.py:62:5

concatenated bytes literal contains 75 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
REQUEST_BODY_COMPRESSED = (
    b'\x1f\x8b\x08\x00\x01\x00\x00\x00\x02\xffsL.\xc9\xcc\xcf\xb3\r(-\xf1M-)'
    b'\xcaLvI,IT\x0bK-*\x06\x89\x1a\x19\x18\x1a\xe8\x1aX\xe8\x1a\x18\xaa\xf9%'
    b'\xe6\xa6\x16\x17$&\xa7\xda\xc2Yj\x08\x1dz\xb9\xa9\xb9I\xa9Ez\x86z\x101\x90'
```
likely benign LLM, confidence 0.92 A gzip-compressed request body stored as a bytes literal in a compression test.
Reasoning
The bytes literal begins with the gzip magic header 1f 8b and holds a pre-compressed request body. It is a fixture for testing compression in a test file, not a concealed payload executed at runtime.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_eventstream.py:149:9

concatenated bytes literal contains 63 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"\x00\x00\x00\x62\x00\x00\x00\x52\x03\xb5\xcb\x9c"
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
```
likely benign LLM, confidence 0.92 A binary event-stream frame literal used as a parsing test fixture.
Reasoning
The bytes are a binary event-stream frame with length and header fields, used as an expected wire-format fixture in a parser test. The hex escapes reflect binary protocol data, not obfuscation of malicious logic.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_eventstream.py:364:9

concatenated bytes literal contains 47 `\xNN` escapes (84% of content) — binary payload shape (ast pass, confidence 0.85)
```
    headers_data = (
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
        b"\x016\x06\x00\x05bytes\x017\x07\x00\x04utf8"
```
likely benign LLM, confidence 0.95 Binary event-stream header fixture bytes in a botocore-style unit test.
Reasoning
The snippet is a concatenated bytes literal of binary header records (type/length-prefixed values such as 'bytes' and 'utf8'), which matches a fixture for testing AWS event-stream header parsing in a unit test file. The escapes are expected for binary test data and there is no execution or decoding of a payload.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_httpchecksum.py:828:23

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    (Sha1Checksum, "Kq5sNclPz7QV2+lfQIuc6R7oRu0="),
    (Sha256Checksum, "uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek="),
    (
        Sha512Checksum,
```
likely benign LLM, confidence 0.93 Base64-encoded SHA-1 and SHA-256 expected checksum values in a parametrized test.
Reasoning
The base64 strings are 20- and 32-byte digests (Sha1/Sha256 values) paired with checksum class names in a parametrized test table. They are expected checksum outputs, not hidden code or payloads.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_httpchecksum.py:831:10

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
        Sha512Checksum,
        "MJ7MSJwS1utMxA9QyQLytNDtd+5RGnx6m808qG1M2G+YndNbxf9JlnDaNCVbRbDP2DDoH2Bdz33FVC6TrpzXbw==",
    ),
]
```
likely benign LLM, confidence 0.93 Base64-encoded SHA-512 expected checksum value in a parametrized test.
Reasoning
The 88-character base64 string decodes to a 64-byte SHA-512 digest, and it is the expected value paired with Sha512Checksum in the same test table. This is ordinary test data.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:40:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyJdXSwgImZvbyI6ICJZbUZ5In0='
        )
        expected = {'foo': b'bar'}
```
likely benign LLM, confidence 0.93 Base64 pagination token fixture that encodes a JSON structure, used in a paginator test.
Reasoning
The string decodes to JSON such as {"boto_encoded_keys": [["foo"]], "foo": "YmFy"}, which is a pagination token encoding format. The test asserts the decoded value, so this is a fixture for the paginator's token round-trip.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:55:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiYXIiLCAxXV0sICJmb28i'
            'OiB7ImJhciI6IFsiYmF6IiwgIlltbHUiXX19'
        )
```
likely benign LLM, confidence 0.93 Multi-part base64 pagination token fixture in a paginator test.
Reasoning
This is a concatenated base64-encoded pagination token that decodes to nested JSON with encoded-key metadata. The surrounding test asserts the decoded result, which matches normal paginator test coverage.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:63:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiaW4iXSwgWyJmb28iLCAi'
            'YmFyIl1dLCAiZm9vIjogeyJiaW4iOiAiWW1GdCIsICJiYXIiOiAiWW1GNiJ9fQ=='
        )
```
likely benign LLM, confidence 0.93 Base64 pagination token fixture for a nested-key paginator test.
Reasoning
The concatenated base64 string is a pagination token that decodes to JSON with boto-encoded keys, and the test checks the decoded structure. It is test input for the paginator, not a payload.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:64:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiaW4iXSwgWyJmb28iLCAi'
            'YmFyIl1dLCAiZm9vIjogeyJiaW4iOiAiWW1GdCIsICJiYXIiOiAiWW1GNiJ9fQ=='
        )
        expected = {'foo': {'bar': b'baz', 'bin': b'bam'}}
```
likely benign LLM, confidence 0.93 Continuation of a base64 pagination token fixture in a paginator test.
Reasoning
This is the continuation of the same base64 pagination token fixture, with the expected decoded dictionary given right after. It is a standard round-trip test case.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/boto/botocore botocore && cd botocore
git checkout 1.43.113
disclude scan --severity info --diff 1.43.112 .