botocore 1.43.115

Source: https://github.com/boto/botocore
Tag scanned: 1.43.115
Compared with: 1.43.114 (0 signals introduced since)
Files: 331 scanned, 3148 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 30 info
Scan time: 25.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 30 of 30 warn and critical signals; 30 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 00:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-import botocore/vendored/six.py:87:5

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    """Import module, returning the module after the last dot."""
    __import__(name)
    return sys.modules[name]
```
likely benign LLM, confidence 0.85 Vendored six compatibility helper that imports a module by dynamic name.
Reasoning
This is the standard six.py `_import_module` helper, which imports a module by name. The non-literal __import__ is expected for a compatibility library that loads modules dynamically. The name is internal, not attacker-controlled input.
info ~~critical~~ → info by review frame-introspection botocore/vendored/six.py:728:21

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
        if _globs_ is None:
            frame = sys._getframe(1)
            _globs_ = frame.f_globals
            if _locs_ is None:
```
likely benign LLM, confidence 0.90 Vendored six exec_ shim reading caller frame globals for exec in the calling namespace.
Reasoning
This is the well-known six.py exec_ helper that reads caller globals/locals via sys._getframe(1) to execute code in the caller's namespace. It is a standard, documented compatibility shim, and the anti-analysis heuristic is a false match on the file-level exec usage.
info ~~warn~~ → info by review dynamic-execution scripts/new-change:123:13

`subprocess.Popen` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        editor = env.get('VISUAL', env.get('EDITOR', 'vim'))
        p = subprocess.Popen(f'{editor} {f.name}', shell=True)
        p.communicate()
        with open(f.name) as f:
```
likely benign LLM, confidence 0.90 Dev script launching the user's editor through a shell command.
Reasoning
This is a developer script that opens the user's configured $VISUAL or $EDITOR in a shell command. The command comes from the local environment and the temp file name, so shell=True is a convenience, not a remote attack vector.
info ~~warn~~ → info by review decoder-decompress-payload tests/functional/test_compress.py:132:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        serialized_body = f"{additional_params}&{serialized_params}"
        actual_body = gzip.decompress(http_stubber.requests[0].body)
        assert serialized_body.encode('utf-8') == actual_body
```
likely benign LLM, confidence 0.90 Test decompressing a gzip request body to verify its contents.
Reasoning
This is a test asserting that a request body compressed with gzip decompresses to the expected serialized params. Decompressing a response in a test is ordinary and not a hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:230:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                "x-amz-request-algorithm": "SHA256",
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw=",
            },
        ),
```
likely benign LLM, confidence 0.95 Base64-encoded SHA256 checksum literal in an HTTP checksum test.
Reasoning
This is an AWS SHA256 checksum value (base64 of 32 bytes) used as an expected header in a test vector. Checksums in test fixtures are normal.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:238:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
                "x-amz-request-algorithm": "SHA512",
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw==",
            },
        ),
```
likely benign LLM, confidence 0.95 Base64-encoded SHA512 checksum literal in an HTTP checksum test.
Reasoning
This is a SHA512 checksum base64 literal used as an expected header value in a test fixture, which is normal for checksum testing.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:357:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw="
            },
        ),
```
likely benign LLM, confidence 0.95 Repeated base64 SHA256 checksum literal in a test fixture.
Reasoning
Same SHA256 checksum literal reused as an expected header value in a test case. Benign test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:369:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw=="
            },
        ),
```
likely benign LLM, confidence 0.95 Repeated base64 SHA512 checksum literal in a test fixture.
Reasoning
Same SHA512 checksum literal reused in a test case. Benign test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:478:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw="
            },
        ),
```
likely benign LLM, confidence 0.95 Repeated base64 SHA256 checksum literal in a test fixture.
Reasoning
Repeated SHA256 checksum literal in a test fixture. Benign.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:485:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw=="
            },
        ),
```
likely benign LLM, confidence 0.95 Repeated base64 SHA512 checksum literal in a test fixture.
Reasoning
Repeated SHA512 checksum literal in a test fixture. Benign.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:594:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {"x-amz-checksum-sha256": "bm90LWEtY2hlY2tzdW0="},
            "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw=",
        ),
        (
```
likely benign LLM, confidence 0.95 Base64 SHA256 checksum literal in parametrized checksum tests.
Reasoning
SHA256 checksum literal used as parametrized test input alongside a 'not-a-checksum' value. Clearly test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:600:14

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {"x-amz-checksum-sha512": "bm90LWEtY2hlY2tzdW0="},
            "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw==",
        ),
    ]
```
likely benign LLM, confidence 0.95 Base64 SHA512 checksum literal in parametrized checksum tests.
Reasoning
SHA512 checksum literal in parametrized checksum test data. Benign.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/aws4_testsuite/post-sts-token/readme.txt:15:1

base64-like blob (336 bytes, compression ratio 0.85) (raw pass, confidence 0.60)
```
AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabI
```
likely benign LLM, confidence 0.90 Example AWS STS session token in an SigV4 test suite readme.
Reasoning
This is an AWS Signature V4 example security token from the official test suite, with EXAMPLE markers in it. It is documentation/test data, not an embedded payload.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:217:32

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            result,
            ('Foo=%E2%9C%93', 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q='),
        )
```
likely benign LLM, confidence 0.95 Base64 expected signature value in a signer unit test.
Reasoning
This is a base64 expected output for a URL-encoded HMAC/signature test vector. Test expectation data, benign.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:231:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            request.data['Signature'],
            'Tiecw+t51tok4dTT8B4bg47zxHEM/KcD55f2/x6K22o=',
        )
        self.assertEqual(request.data['SignatureMethod'], 'HmacSHA256')
```
dismissed LLM, confidence 0.93 Expected HMAC signature constant in a signer unit test.
Reasoning
Raw-pass base64 match on a 44-byte HMAC-SHA256 signature literal compared against computed output in a unit test. Signature fixtures are expected test data, and the raw pass has a high false-positive rate.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:243:27

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            'Foo': '\u2713',
            'Signature': 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q=',
        }
        result = self.signer.calc_signature(request, params)
```
dismissed LLM, confidence 0.93 Signature test vector in a signer test's params dict.
Reasoning
A base64 signature value placed in a request params dict inside a test case that calls calc_signature. This is a fixed test vector, not a payload or dropper.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:248:32

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            result,
            ('Foo=%E2%9C%93', 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q='),
        )
```
dismissed LLM, confidence 0.93 Expected signature in an assertEqual in a signer test.
Reasoning
The base64 value is the expected signature in an assertEqual tuple after a signing call. This is a standard test assertion.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:262:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            request.params['Signature'],
            'Un97klqZCONP65bA1+Iv4H3AcB2I40I4DBvw5ZERFPw=',
        )
        self.assertEqual(request.params['SignatureMethod'], 'HmacSHA256')
```
dismissed LLM, confidence 0.93 Expected signature constant asserted in a signer test.
Reasoning
Same pattern as the other signer tests: a fixed expected signature compared against the output of the signing code under test.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:294:18

base64-like blob (54 bytes, compression ratio 1.20) (raw pass, confidence 0.60)
```
                'AWS3-HTTPS AWSAccessKeyId=access_key,Algorithm=HmacSHA256,'
                'Signature=M245fo86nVKI8rLpH4HgWs841sBTUKuwciiTpjMDgPs='
            ),
        )
```
dismissed LLM, confidence 0.93 Expected AWS3 signature header value in a test string.
Reasoning
Inside a test string literal, a base64-like signature component of an AWS3-HTTPS authorization header. It is an expected header value in a test.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_auth_bearer.py:30:19

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
        "headers": {},
        "token": "eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE=",
        "expectedHeaders": {
            "Authorization": "Bearer eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE="
```
likely benign LLM, confidence 0.92 Placeholder bearer token fixture in an auth test.
Reasoning
The value decodes to a joke string ('you're not supposed to decode this!') and is used as a bearer token fixture in a parameterized auth test. It is a placeholder with no malicious function.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_auth_bearer.py:32:38

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
        "expectedHeaders": {
            "Authorization": "Bearer eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE="
        },
    },
```
likely benign LLM, confidence 0.92 Expected Bearer header containing the placeholder token.
Reasoning
The same placeholder token appears in the expected Authorization header of the test case. It is a consistent test fixture.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_compress.py:62:5

concatenated bytes literal contains 75 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
REQUEST_BODY_COMPRESSED = (
    b'\x1f\x8b\x08\x00\x01\x00\x00\x00\x02\xffsL.\xc9\xcc\xcf\xb3\r(-\xf1M-)'
    b'\xcaLvI,IT\x0bK-*\x06\x89\x1a\x19\x18\x1a\xe8\x1aX\xe8\x1a\x18\xaa\xf9%'
    b'\xe6\xa6\x16\x17$&\xa7\xda\xc2Yj\x08\x1dz\xb9\xa9\xb9I\xa9Ez\x86z\x101\x90'
```
likely benign LLM, confidence 0.90 Gzip-compressed request body fixture for a compression test.
Reasoning
A bytes literal of a gzip stream used as a request body fixture for compression tests. Binary payload shape is expected because the test verifies compressed output.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_eventstream.py:149:9

concatenated bytes literal contains 63 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"\x00\x00\x00\x62\x00\x00\x00\x52\x03\xb5\xcb\x9c"
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
```
likely benign LLM, confidence 0.90 Binary eventstream header fixture for parser tests.
Reasoning
Hand-built binary eventstream header bytes used to exercise a protocol parser. This is required test data for binary wire-format decoding.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_eventstream.py:364:9

concatenated bytes literal contains 47 `\xNN` escapes (84% of content) — binary payload shape (ast pass, confidence 0.85)
```
    headers_data = (
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
        b"\x016\x06\x00\x05bytes\x017\x07\x00\x04utf8"
```
likely benign LLM, confidence 0.90 Binary eventstream headers fixture in a test.
Reasoning
Binary header-encoding bytes in a test fixture for the eventstream parser. Escaped bytes are the natural way to express a binary wire format.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_httpchecksum.py:828:23

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    (Sha1Checksum, "Kq5sNclPz7QV2+lfQIuc6R7oRu0="),
    (Sha256Checksum, "uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek="),
    (
        Sha512Checksum,
```
dismissed LLM, confidence 0.92 Expected checksum digest values in a parameterized test table.
Reasoning
Base64 digests of known inputs, listed as a table of (checksum class, expected value) pairs for a checksum test. These are expected test vectors.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_httpchecksum.py:831:10

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
        Sha512Checksum,
        "MJ7MSJwS1utMxA9QyQLytNDtd+5RGnx6m808qG1M2G+YndNbxf9JlnDaNCVbRbDP2DDoH2Bdz33FVC6TrpzXbw==",
    ),
]
```
dismissed LLM, confidence 0.92 Expected SHA-512 digest value in a checksum test table.
Reasoning
The final entry of the same expected-digest table, a base64 SHA-512 value. It is a test vector with no execution or exfiltration role.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:40:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyJdXSwgImZvbyI6ICJZbUZ5In0='
        )
        expected = {'foo': b'bar'}
```
dismissed LLM, confidence 0.92 Encoded pagination token fixture in a paginator test.
Reasoning
A base64 pagination token that decodes to JSON with encoded keys, used as input to the paginator's token decoding. It is a test fixture for a legitimate feature.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:55:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiYXIiLCAxXV0sICJmb28i'
            'OiB7ImJhciI6IFsiYmF6IiwgIlltbHUiXX19'
        )
```
dismissed LLM, confidence 0.92 Multi-line encoded pagination token in a paginator test.
Reasoning
A multi-part base64 pagination token passed to paginator decoding. It is test data for a documented pagination mechanism.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:63:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiaW4iXSwgWyJmb28iLCAi'
            'YmFyIl1dLCAiZm9vIjogeyJiaW4iOiAiWW1GdCIsICJiYXIiOiAiWW1GNiJ9fQ=='
        )
```
dismissed LLM, confidence 0.93 Base64-encoded JSON pagination token used as test fixture data in test_paginate.py.
Reasoning
Raw-pass base64 hit in a unit test. The blob decodes to a JSON pagination token containing a 'boto_encoded_keys' field and nested 'foo'/'bin'/'bar' keys, with values that are themselves base64. This is a deliberately constructed test fixture for pagination-token round-tripping, not a payload. The file is a test, the content is readable structured data, and the raw pass has a high false-positive rate for base64-looking strings.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:64:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiaW4iXSwgWyJmb28iLCAi'
            'YmFyIl1dLCAiZm9vIjogeyJiaW4iOiAiWW1GdCIsICJiYXIiOiAiWW1GNiJ9fQ=='
        )
        expected = {'foo': {'bar': b'baz', 'bin': b'bam'}}
```
dismissed LLM, confidence 0.93 Second half of the same base64 pagination-token fixture, followed by an expected-value assertion in a unit test.
Reasoning
This is the continuation of the same split base64 string literal, which concatenates into the same pagination-token fixture. The following line asserts the expected decoded dict {'foo': {'bar': b'baz', 'bin': b'bam'}}, confirming the blob is round-trip test data for a paginator's encoded-keys feature. No execution or decoding of untrusted input is present.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/boto/botocore botocore && cd botocore
git checkout 1.43.115
disclude scan --severity info --diff 1.43.114 .