botocore 1.43.116

Source: https://github.com/boto/botocore
Tag scanned: 1.43.116
Compared with: 1.43.115 (0 signals introduced since)
Files: 331 scanned, 3148 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 30 info
Scan time: 23.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 30 of 30 warn and critical signals; 30 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-21 00:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-import botocore/vendored/six.py:87:5

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    """Import module, returning the module after the last dot."""
    __import__(name)
    return sys.modules[name]
```
likely benign LLM, confidence 0.85 Vendored six compatibility helper that dynamically imports a module by name.
Reasoning
six.py's import_module helper is the standard compatibility shim calling __import__ on a parameter; this is a known legitimate pattern in the vendored six library, not a dropper.
info ~~critical~~ → info by review frame-introspection botocore/vendored/six.py:728:21

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
        if _globs_ is None:
            frame = sys._getframe(1)
            _globs_ = frame.f_globals
            if _locs_ is None:
```
likely benign LLM, confidence 0.85 Vendored six exec_ helper fetching caller frame globals for default execution scope.
Reasoning
sys._getframe(1) inside six's exec_ wrapper is used to default globals/locals for exec when caller does not supply them; standard six code, the anti-analysis label is a false association.
info ~~warn~~ → info by review dynamic-execution scripts/new-change:123:13

`subprocess.Popen` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        editor = env.get('VISUAL', env.get('EDITOR', 'vim'))
        p = subprocess.Popen(f'{editor} {f.name}', shell=True)
        p.communicate()
        with open(f.name) as f:
```
likely benign LLM, confidence 0.80 Developer script opening the user's editor on a temporary file via shell=True.
Reasoning
Launches the user's $VISUAL/$EDITOR via shell with a temp file name; a common editor-invocation pattern in a dev script. Minor injection surface but not malicious.
info ~~warn~~ → info by review decoder-decompress-payload tests/functional/test_compress.py:132:23

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        serialized_body = f"{additional_params}&{serialized_params}"
        actual_body = gzip.decompress(http_stubber.requests[0].body)
        assert serialized_body.encode('utf-8') == actual_body
```
likely benign LLM, confidence 0.90 Functional test decompressing a gzip request body to check its contents.
Reasoning
Test code decompressing a gzip request body captured by a stubber to verify serialization; ordinary test assertion, no embedded payload executed.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:230:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
                "x-amz-request-algorithm": "SHA256",
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw=",
            },
        ),
```
likely benign LLM, confidence 0.95 Expected x-amz-checksum-sha256 header value in an HTTP checksum test.
Reasoning
Base64 SHA256 checksum expected value in an AWS SDK test fixture; test data, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:238:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
                "x-amz-request-algorithm": "SHA512",
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw==",
            },
        ),
```
likely benign LLM, confidence 0.95 Expected x-amz-checksum-sha512 header value in an HTTP checksum test.
Reasoning
Base64 SHA512 checksum value in test fixture for AWS checksum headers.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:357:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw="
            },
        ),
```
likely benign LLM, confidence 0.95 Expected SHA256 checksum header in a test case.
Reasoning
Same SHA256 checksum test fixture repeated; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:369:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw=="
            },
        ),
```
likely benign LLM, confidence 0.95 Expected SHA512 checksum header in a test case.
Reasoning
Same SHA512 checksum test fixture; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:478:43

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha256": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw="
            },
        ),
```
likely benign LLM, confidence 0.95 Expected SHA256 checksum header in a test case.
Reasoning
Repeated SHA256 checksum test fixture; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:485:43

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {
                "x-amz-checksum-sha512": "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw=="
            },
        ),
```
likely benign LLM, confidence 0.95 Expected SHA512 checksum header in a test case.
Reasoning
Repeated SHA512 checksum test fixture; legitimate test data.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:594:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            {"x-amz-checksum-sha256": "bm90LWEtY2hlY2tzdW0="},
            "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw=",
        ),
        (
```
likely benign LLM, confidence 0.95 Parametrized test expected SHA256 checksum value.
Reasoning
Checksum expected-value tuple in parametrized test; base64 of known digest, benign.
info ~~warn~~ → info by review encoding-base64 tests/functional/test_httpchecksum.py:600:14

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
            {"x-amz-checksum-sha512": "bm90LWEtY2hlY2tzdW0="},
            "t/eDuu2Cl/DbkXRiGE/08I5pwtXl95qUJgD5cl9Yzh8pwYE5v4CwbA//K900c4RS7PQMSIwip+PYDN9vnBwNRw==",
        ),
    ]
```
likely benign LLM, confidence 0.95 Parametrized test expected SHA512 checksum value.
Reasoning
Checksum expected-value tuple in parametrized test; benign test data.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/aws4_testsuite/post-sts-token/readme.txt:15:1

base64-like blob (336 bytes, compression ratio 0.85) (raw pass, confidence 0.60)
```
AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabI
```
likely benign LLM, confidence 0.93 Sample AWS STS session token in SigV4 test suite documentation.
Reasoning
AWS Signature V4 test-suite readme containing an example session token (EXAMPLE-marked sample credential); documentation data, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:217:32

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            result,
            ('Foo=%E2%9C%93', 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q='),
        )
```
likely benign LLM, confidence 0.95 Expected base64 value in a signer test case.
Reasoning
Expected base64 digest in a signer unit test for URL-encoded input; test fixture.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:231:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            request.data['Signature'],
            'Tiecw+t51tok4dTT8B4bg47zxHEM/KcD55f2/x6K22o=',
        )
        self.assertEqual(request.data['SignatureMethod'], 'HmacSHA256')
```
likely benign LLM, confidence 0.95 Expected AWS request signature constant in a signer unit test.
Reasoning
The blob is an expected HMAC-SHA256 signature value in a unit test assertion, compared against computed output. Raw-pass base64 heuristics fire on any 44-char base64 string, and this one sits in a test fixture.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:243:27

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            'Foo': '\u2713',
            'Signature': 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q=',
        }
        result = self.signer.calc_signature(request, params)
```
likely benign LLM, confidence 0.95 Test-fixture signature value passed into a signer test.
Reasoning
The value is the 'Signature' entry of a test params dict used as input to calc_signature. It is a fixture with no decoding or execution path.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:248:32

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            result,
            ('Foo=%E2%9C%93', 'VCtWuwaOL0yMffAT8W4y0AFW3W4KUykBqah9S40rB+Q='),
        )
```
likely benign LLM, confidence 0.95 Expected signature in a tuple assertion in a signer test.
Reasoning
The base64 string is an expected-result tuple member in an assertEqual against signer output. It is a test expectation, not a payload.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:262:14

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            request.params['Signature'],
            'Un97klqZCONP65bA1+Iv4H3AcB2I40I4DBvw5ZERFPw=',
        )
        self.assertEqual(request.params['SignatureMethod'], 'HmacSHA256')
```
likely benign LLM, confidence 0.95 Expected signature constant in a signer test assertion.
Reasoning
This is an expected signature value compared with assertEqual in a test of request params. It is a fixture constant.
info ~~warn~~ → info by review encoding-base64 tests/unit/auth/test_signers.py:294:18

base64-like blob (54 bytes, compression ratio 1.20) (raw pass, confidence 0.60)
```
                'AWS3-HTTPS AWSAccessKeyId=access_key,Algorithm=HmacSHA256,'
                'Signature=M245fo86nVKI8rLpH4HgWs841sBTUKuwciiTpjMDgPs='
            ),
        )
```
likely benign LLM, confidence 0.94 Expected AWS3-HTTPS Authorization header value in a test.
Reasoning
The string is a fixture Authorization header signature inside a test expectation for the AWS3-HTTPS scheme. No runtime decode or execution is present.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_auth_bearer.py:30:19

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
        "headers": {},
        "token": "eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE=",
        "expectedHeaders": {
            "Authorization": "Bearer eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE="
```
likely benign LLM, confidence 0.95 Dummy bearer token fixture used in an auth header test.
Reasoning
The token decodes to the joke string "you're not supposed to decode this!". It is a dummy bearer token in a test case with no decoding or execution behavior in the snippet.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_auth_bearer.py:32:38

base64-like blob (48 bytes, compression ratio 1.23) (raw pass, confidence 0.60)
```
        "expectedHeaders": {
            "Authorization": "Bearer eW91J3JlIG5vdCBzdXBwb3NlZCB0byBkZWNvZGUgdGhpcyE="
        },
    },
```
likely benign LLM, confidence 0.95 Expected Bearer Authorization header with a dummy token.
Reasoning
This is the same dummy token appearing in the expectedHeaders of the test case. It is test data.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_compress.py:62:5

concatenated bytes literal contains 75 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
REQUEST_BODY_COMPRESSED = (
    b'\x1f\x8b\x08\x00\x01\x00\x00\x00\x02\xffsL.\xc9\xcc\xcf\xb3\r(-\xf1M-)'
    b'\xcaLvI,IT\x0bK-*\x06\x89\x1a\x19\x18\x1a\xe8\x1aX\xe8\x1a\x18\xaa\xf9%'
    b'\xe6\xa6\x16\x17$&\xa7\xda\xc2Yj\x08\x1dz\xb9\xa9\xb9I\xa9Ez\x86z\x101\x90'
```
likely benign LLM, confidence 0.93 Gzip-compressed request body fixture in a compression test.
Reasoning
The bytes literal begins with the gzip magic header (\x1f\x8b) and is a recorded compressed request body fixture for a compression test. Binary escapes are the expected form for such data.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_eventstream.py:149:9

concatenated bytes literal contains 63 `\xNN` escapes (88% of content) — binary payload shape (ast pass, confidence 0.85)
```
    (
        b"\x00\x00\x00\x62\x00\x00\x00\x52\x03\xb5\xcb\x9c"
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
```
likely benign LLM, confidence 0.93 Binary event-stream header fixture for an eventstream parser test.
Reasoning
The bytes are AWS event-stream binary header encoding (type/length-prefixed headers) in a parser test fixture. The escape density matches binary protocol data written in test code.
info ~~warn~~ → info by review payload-bytes-literal tests/unit/test_eventstream.py:364:9

concatenated bytes literal contains 47 `\xNN` escapes (84% of content) — binary payload shape (ast pass, confidence 0.85)
```
    headers_data = (
        b"\x010\x00\x011\x01\x012\x02\x02\x013\x03\x00\x03"
        b"\x014\x04\x00\x00\x00\x04\x015\x05\x00\x00\x00\x00\x00\x00\x00\x05"
        b"\x016\x06\x00\x05bytes\x017\x07\x00\x04utf8"
```
likely benign LLM, confidence 0.93 Serialized event-stream headers fixture in an eventstream test.
Reasoning
This is a binary header-encoding fixture ('bytes', 'utf8' header names and types) in an eventstream test. It is a serialized protocol sample, not a payload that executes.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_httpchecksum.py:828:23

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
    (Sha1Checksum, "Kq5sNclPz7QV2+lfQIuc6R7oRu0="),
    (Sha256Checksum, "uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek="),
    (
        Sha512Checksum,
```
likely benign LLM, confidence 0.94 Known-answer checksum digests in an HTTP checksum test table.
Reasoning
These are expected base64 digests for SHA-1 and SHA-256 test vectors paired with checksum classes. They are known-answer test data.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_httpchecksum.py:831:10

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
        Sha512Checksum,
        "MJ7MSJwS1utMxA9QyQLytNDtd+5RGnx6m808qG1M2G+YndNbxf9JlnDaNCVbRbDP2DDoH2Bdz33FVC6TrpzXbw==",
    ),
]
```
likely benign LLM, confidence 0.94 Expected SHA-512 checksum vector in a parametrized test.
Reasoning
This is the expected SHA-512 base64 digest in a parametrized checksum test table. It is a known-answer test vector.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:40:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyJdXSwgImZvbyI6ICJZbUZ5In0='
        )
        expected = {'foo': b'bar'}
```
likely benign LLM, confidence 0.94 Encoded pagination token fixture for a paginator test.
Reasoning
The string is a base64 pagination token encoding JSON with bytes-encoded keys, provided as test input to a paginator decode test. It is application test data.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:55:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiYXIiLCAxXV0sICJmb28i'
            'OiB7ImJhciI6IFsiYmF6IiwgIlltbHUiXX19'
        )
```
likely benign LLM, confidence 0.94 Multi-line base64 pagination token fixture in a paginator test.
Reasoning
This is a multi-part base64 pagination token fixture used to exercise paginator token decoding. The content is ordinary test data.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:63:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        token = (
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiaW4iXSwgWyJmb28iLCAi'
            'YmFyIl1dLCAiZm9vIjogeyJiaW4iOiAiWW1GdCIsICJiYXIiOiAiWW1GNiJ9fQ=='
        )
```
likely benign LLM, confidence 0.95 A base64-encoded pagination token fixture (boto-style continuation token) in a Python unit test.
Reasoning
The raw pass flagged a base64 blob in a unit test. It decodes to JSON with a 'boto_encoded_keys' field and nested 'foo'/'bar'/'bin' keys, which is the format of a pagination continuation token. The test expects a dict with b'baz' and b'bam' values, so this is a test fixture for encoded pagination tokens, not a payload. Raw-pass findings have a high false-positive rate, and nothing here is executed or hidden.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_paginate.py:64:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            'eyJib3RvX2VuY29kZWRfa2V5cyI6IFtbImZvbyIsICJiaW4iXSwgWyJmb28iLCAi'
            'YmFyIl1dLCAiZm9vIjogeyJiaW4iOiAiWW1GdCIsICJiYXIiOiAiWW1GNiJ9fQ=='
        )
        expected = {'foo': {'bar': b'baz', 'bin': b'bam'}}
```
likely benign LLM, confidence 0.95 Continuation of the same base64-encoded pagination token fixture in the unit test.
Reasoning
This is the second half of the same base64 string split across adjacent literals, flagged again by the raw pass. It is the continuation of the pagination token fixture that the test decodes and compares against the expected dict. No decoding or execution of the blob occurs in the snippet, and the surrounding code is a test assertion.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/boto/botocore botocore && cd botocore
git checkout 1.43.116
disclude scan --severity info --diff 1.43.115 .