botocore 1.43.114

Source: https://github.com/boto/botocore
Tag scanned: 1.43.114
Compared with: 1.43.113 (0 signals introduced since)
Files: 331 scanned, 3148 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 30 info
Scan time: 22.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 30 of 30 warn and critical signals; 30 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-15 16:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-import botocore/vendored/six.py:87:5

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    """Import module, returning the module after the last dot."""
    __import__(name)
    return sys.modules[name]
```
likely benign LLM, confidence 0.85 Vendored six.py helper that imports a module by name via __import__.
Reasoning
This is the standard six.py import_module helper, which calls __import__ on a caller-supplied name. Dynamic import is expected in a vendored compatibility library and the function has no encoded payload or hidden trigger.
info ~~critical~~ → info by review frame-introspection botocore/vendored/six.py:728:21

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
        if _globs_ is None:
            frame = sys._getframe(1)
            _globs_ = frame.f_globals
            if _locs_ is None:
```
likely benign LLM, confidence 0.85 Vendored six.py exec_ helper reading the caller's frame globals.
Reasoning
This is six's exec_ helper fallback that uses sys._getframe to read caller globals when none are passed. It is a known legitimate pattern in six; the anti-analysis label is a heuristic false positive from the file containing exec.
info ~~warn~~ → info by review dynamic-execution scripts/new-change:123:13

`subprocess.Popen` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        editor = env.get('VISUAL', env.get('EDITOR', 'vim'))
        p = subprocess.Popen(f'{editor} {f.name}', shell=True)
        p.communicate()
        with open(f.name) as f:
```
likely benign LLM, confidence 0.80 Launches the user's editor on a temp file via shell=True.
Reasoning
The shell=True command interpolates the user's EDITOR/VISUAL environment variable to open a changelog file. This is a common editor-launch idiom with no attacker-controlled remote input, though shell=True with an interpolated filename is a minor injection risk.
info ~~warn~~ → info by review decoder-decompress-payload tests/functional/test_compress.py:132:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        serialized_body = f"{additional_params}&{serialized_params}"
        actual_body = gzip.decompress(http_stubber.requests[0].body)
        assert serialized_body.encode('utf-8') == actual_body
```
likely benign LLM, confidence 0.90 Test decompresses a recorded request body to verify its contents.
Reasoning
This is a test asserting that a gzip-compressed request body decodes to the expected serialized params. Decompressing a stubbed HTTP body in a test is ordinary and contains no hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:230:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                "x-amz-request-algorithm": "SHA256",
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw=",
            },
        ),
```
likely benign LLM, confidence 0.97 Expected base64 SHA256 checksum header value in a test.
Reasoning
This is a documented AWS SHA256 checksum value (base64 of a digest) used as an expected header in a test fixture. Base64 checksums are normal here.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:238:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
                "x-amz-request-algorithm": "SHA512",
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw==",
            },
        ),
```
likely benign LLM, confidence 0.97 Expected base64 SHA512 checksum header value in a test.
Reasoning
This is a standard base64-encoded SHA512 checksum value used as an expected header in a test fixture.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:357:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw="
            },
        ),
```
likely benign LLM, confidence 0.97 Expected base64 SHA256 checksum header value in a test.
Reasoning
Repeat of the same legitimate SHA256 checksum fixture value in a test.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:369:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw=="
            },
        ),
```
likely benign LLM, confidence 0.97 Expected base64 SHA512 checksum header value in a test.
Reasoning
Repeat of the same legitimate SHA512 checksum fixture value in a test.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:478:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw="
            },
        ),
```
likely benign LLM, confidence 0.97 Expected base64 SHA256 checksum header value in a test.
Reasoning
Repeat of the same legitimate SHA256 checksum fixture value in a test.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:485:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw=="
            },
        ),
```
likely benign LLM, confidence 0.97 Expected base64 SHA512 checksum header value in a test.
Reasoning
Repeat of the same legitimate SHA512 checksum fixture value in a test.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:594:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {"x-amz-checksum-sha256": "bm90LWEtY2hlY2tzdW0="},
            "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw=",
        ),
        (
```
likely benign LLM, confidence 0.97 Expected base64 SHA256 checksum in a parametrized test.
Reasoning
Legitimate SHA256 checksum test fixture value, paired with a deliberately wrong checksum for a negative case.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:600:14

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {"x-amz-checksum-sha512": "bm90LWEtY2hlY2tzdW0="},
            "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw==",
        ),
    ]
```
likely benign LLM, confidence 0.97 Expected base64 SHA512 checksum in a parametrized test.
Reasoning
Legitimate SHA512 checksum test fixture value in a parametrized test.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/aws4_testsuite/post-sts-token/readme.txt:15:1

base64-like blob (336 bytes, compression ratio 0.85) (raw pass, confidence 0.60)
```
AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabI
```
likely benign LLM, confidence 0.95 Sample AWS STS session token in SigV4 test suite readme.
Reasoning
This is an AWS documentation example security token from the official SigV4 test suite, a sample credential with EXAMPLE markers. It is test data, not a payload.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:217:32

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            result,
            ('Foo=%E2%9C%93', 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q='),
        )
```
likely benign LLM, confidence 0.95 Expected base64 digest value in a signer unit test.
Reasoning
This is a base64 SHA256 digest of a test string used as an expected signing/checksum value in a unit test. Expected test data.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:231:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            request.data['Signature'],
            'Tiecw+t51tok4dTT8B4bg47zxHEM/KcD55f2/x6K22o=',
        )
        self.assertEqual(request.data['SignatureMethod'], 'HmacSHA256')
```
likely benign LLM, confidence 0.93 Expected HMAC signature test vector in a signer unit test.
Reasoning
The blob is an expected HMAC-SHA256 signature value in a unit test asserting the signer's output. Test vectors like this are normal in an SDK test suite and carry no obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:243:27

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            'Foo': '\u2713',
            'Signature': 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q=',
        }
        result = self.signer.calc_signature(request, params)
```
likely benign LLM, confidence 0.93 Expected signature constant in a signer test.
Reasoning
The base64 value is the expected signature in a test that checks calc_signature output. This is a legitimate fixture from a botocore-style test suite.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:248:32

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            result,
            ('Foo=%E2%9C%93', 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q='),
        )
```
likely benign LLM, confidence 0.93 Expected signature value in a tuple assertion.
Reasoning
The value is the expected signature paired with a canonical query string in an assertion. It is a test vector and not a payload.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:262:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            request.params['Signature'],
            'Un97klqZCONP65bA1+Iv4H3AcB2I40I4DBvw5ZERFPw=',
        )
        self.assertEqual(request.params['SignatureMethod'], 'HmacSHA256')
```
likely benign LLM, confidence 0.93 Expected signature in a params-based signer test.
Reasoning
This is an expected HmacSHA256 signature compared against request parameters in a unit test. It is ordinary test data.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:294:18

base64-like blob (54 bytes, compression ratio 1.20) (raw pass, confidence 0.60)
```
                'AWS3-HTTPS AWSAccessKeyId=access_key,Algorithm=HmacSHA256,'
                'Signature=M245fo86nVKI8rLpH4HgWs841sBTUKuwciiTpjMDgPs='
            ),
        )
```
likely benign LLM, confidence 0.92 Expected signature inside an authorization header assertion.
Reasoning
The value is an expected Signature field embedded in an AWS3-HTTPS authorization header string inside an assertion. This is a test fixture.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_auth_bearer.py:30:19

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
        "headers": {},
        "token": "eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE=",
        "expectedHeaders": {
            "Authorization": "Bearer eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE="
```
likely benign LLM, confidence 0.90 Placeholder bearer token with a joking base64 value.
Reasoning
The token decodes to the plain text 'you're not supposed to decode this!', a deliberately joking placeholder used as a bearer token in test data. It is not a hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_auth_bearer.py:32:38

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
        "expectedHeaders": {
            "Authorization": "Bearer eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE="
        },
    },
```
likely benign LLM, confidence 0.90 Expected Bearer authorization header in a test case.
Reasoning
This is the expected Authorization header built from the same placeholder token in a test case. It is benign test data.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_compress.py:62:5

concatenated bytes literal contains 75 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
REQUEST_BODY_COMPRESSED = (
    b'\x1f\x8b\x08\x00\x01\x00\x00\x00\x02\xffsL.\xc9\xcc\xcf\xb3\r(-\xf1M-)'
    b'\xcaLvI,IT\x0bK-*\x06\x89\x1a\x19\x18\x1a\xe8\x1aX\xe8\x1a\x18\xaa\xf9%'
    b'\xe6\xa6\x16\x17$&\xa7\xda\xc2Yj\x08\x1dz\xb9\xa9\xb9I\xa9Ez\x86z\x101\x90'
```
likely benign LLM, confidence 0.90 Gzip-compressed request body fixture in a compression test.
Reasoning
The bytes literal begins with the gzip magic header and is a recorded compressed request body used for a compression test. Binary fixtures like this are expected in this context.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_eventstream.py:149:9

concatenated bytes literal contains 63 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"\x00\x00\x00\x62\x00\x00\x00\x52\x03\xb5\xcb\x9c"
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
```
likely benign LLM, confidence 0.90 Binary event-stream header fixture for a parser test.
Reasoning
The escapes encode event-stream binary header bytes (name/type/length fields) for a parser test. Serialized binary fixtures are the normal way to test this format.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_eventstream.py:364:9

concatenated bytes literal contains 47 `\xNN` escapes (84% of content) — binary payload shape (ast pass, confidence 0.85)
```
    headers_data = (
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
        b"\x016\x06\x00\x05bytes\x017\x07\x00\x04utf8"
```
likely benign LLM, confidence 0.90 Encoded event-stream headers fixture in a test.
Reasoning
This is another encoded event-stream header fixture with the same structure, used to test header parsing. It is benign test data.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_httpchecksum.py:828:23

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    (Sha1Checksum, "Kq5sNclPz7QV2+lfQIuc6R7oRu0="),
    (Sha256Checksum, "uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek="),
    (
        Sha512Checksum,
```
likely benign LLM, confidence 0.92 Expected checksum digest vectors in a checksum test table.
Reasoning
These are expected base64 digests of known test input for SHA-1 and SHA-256 checksum tests. They are standard test vectors.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_httpchecksum.py:831:10

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
        Sha512Checksum,
        "MJ7MSJwS1utMxA9QyQLytNDtd+5RGnx6m808qG1M2G+YndNbxf9JlnDaNCVbRbDP2DDoH2Bdz33FVC6TrpzXbw==",
    ),
]
```
likely benign LLM, confidence 0.92 Expected SHA-512 digest vector in a checksum test table.
Reasoning
This is the expected SHA-512 base64 digest in the same checksum test table. It is a standard test vector.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:40:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyJdXSwgImZvbyI6ICJZbUZ5In0='
        )
        expected = {'foo': b'bar'}
```
likely benign LLM, confidence 0.92 Base64 pagination token fixture in a paginator test.
Reasoning
The base64 decodes to a JSON pagination token with boto-encoded keys, used as input to a paginator test. It is a documented token format, not hidden code.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:55:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiYXIiLCAxXV0sICJmb28i'
            'OiB7ImJhciI6IFsiYmF6IiwgIlltbHUiXX19'
        )
```
likely benign LLM, confidence 0.92 Multi-part base64 pagination token fixture in a test.
Reasoning
This is a multi-part base64 pagination token that decodes to JSON state for a paginator test. It is ordinary test input.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:63:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiaW4iXSwgWyJmb28iLCAi'
            'YmFyIl1dLCAiZm9vIjogeyJiaW4iOiAiWW1GdCIsICJiYXIiOiAiWW1GNiJ9fQ=='
        )
```
likely benign LLM, confidence 0.93 Base64-encoded JSON pagination token used as test fixture data in a paginator unit test.
Reasoning
The raw pass flagged a base64 string split across lines in a unit test. The blob decodes to a JSON pagination token (boto_encoded_keys plus nested base64 values 'YmFt'/'YmF6' for b'bam'/b'baz'), which matches the test's expected dict. This is test fixture data for a paginator, not obfuscation. Raw-pass findings have a high false-positive rate, and the context makes the benign reading clear.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:64:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiaW4iXSwgWyJmb28iLCAi'
            'YmFyIl1dLCAiZm9vIjogeyJiaW4iOiAiWW1GdCIsICJiYXIiOiAiWW1GNiJ9fQ=='
        )
        expected = {'foo': {'bar': b'baz', 'bin': b'bam'}}
```
likely benign LLM, confidence 0.93 Second segment of the same base64 pagination token fixture in a paginator unit test.
Reasoning
This is the second half of the same base64 pagination token flagged at line 63. It decodes to the same boto-style JSON continuation token and is asserted against the expected dict on the following line. It is a legitimate test fixture, not a payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/boto/botocore botocore && cd botocore
git checkout 1.43.114
disclude scan --severity info --diff 1.43.113 .