disclude.iobotocore 1.43.116
- Source
- https://github.com/boto/botocore
- Tag scanned
1.43.116- Compared with
1.43.115(0 signals introduced since)- Files
- 339 scanned, 3140 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 32 info
- Scan time
- 22.1 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 31 of 31 warn and critical signals; 31 demoted to info.
- Disclude version
- 4.1.0
- Scanned (UTC)
- 2026-10-21 20:50
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
"""Import module, returning the module after the last dot.""" returnlikely benign A vendored six compatibility helper that imports a module by name.Reasoning
This is the standard `six.import_module` helper in a vendored compatibility library. The non-literal `__import__` is its purpose, and the function is called with module names from library code, not attacker-controlled input.
-
= =likely benign A vendored six shim that reads the caller's globals via frame introspection.Reasoning
This is the `exec_` compatibility shim in six, which uses `sys._getframe(1)` to get the caller's globals when none are given. The anti-analysis label is a heuristic false match on a well-known library idiom.
-
likely benign A long inline SVG path element in a docs template.
Reasoning
The long line is an inline SVG path with numeric coordinate data, a common pattern in documentation templates. It is not an obfuscated payload.
-
-
editor = env.get('VISUAL', env.get('EDITOR', 'vim')) p = subprocess.Popen(f'{editor} {f.name}', shell=True) p.communicate() with open(f.name) as f:likely benign A developer helper script that opens a temp file in the user's editor via a shell command.Reasoning
The script launches the user's editor from VISUAL/EDITOR with shell=True. The command is built from a local environment variable and a temp file name, which is a usual but imperfect pattern. There is no sign of malicious intent.
-
= f = assert ==likely benign A test that gunzips a stubbed HTTP request body to compare it with expected content.Reasoning
This is a test asserting that a gzip-compressed request body matches expected content. Decompressing a recorded request in a test is ordinary and involves no hidden payload.
-
: , : , }, ),likely benign A SHA256 checksum literal used as expected header data in an HTTP checksum test.Reasoning
The base64 value is a 44-character SHA256 checksum literal in a test fixture for the x-amz-checksum header. Checksum literals like this are expected in such tests.
-
: , : , }, ),likely benign A SHA512 checksum literal used as expected header data in an HTTP checksum test.Reasoning
The base64 value is an 88-character SHA512 checksum literal in a test fixture for the x-amz-checksum header. It is expected test data.
-
, ),likely benign A repeated SHA256 checksum literal in a parametrized HTTP checksum test.Reasoning
This is the same SHA256 checksum literal as in the other test cases, used as an expected header value in a parametrized test.
-
, ),likely benign A repeated SHA512 checksum literal in a parametrized HTTP checksum test.Reasoning
This is the same SHA512 checksum literal as in the other test cases, used as expected test data.
-
, ),likely benign A repeated SHA256 checksum literal in HTTP checksum test parameters.Reasoning
This is a repeated SHA256 checksum literal in test parameters for checksum headers. It is expected test data.
-
, ),likely benign A repeated SHA512 checksum literal in HTTP checksum test parameters.Reasoning
This is a repeated SHA512 checksum literal in test parameters for checksum headers. It is expected test data.
-
, , ),likely benign A SHA256 checksum literal used in a checksum mismatch test case.Reasoning
The SHA256 checksum literal sits alongside a deliberately wrong checksum value, a standard negative-case test setup. It is not an encoded payload.
-
, , ), ]likely benign A SHA512 checksum literal used in a checksum mismatch test case.Reasoning
The SHA512 checksum literal sits alongside a deliberately wrong checksum value in a checksum mismatch test case. It is expected test data.
-
info
warn→ info by reviewencoding-base64tests/unit/auth/aws4_testsuite/post-sts-token/readme.txt:15:1AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIlikely benign Sample AWS STS session token base64 blob in a test-suite readme.Reasoning
This is the AWS SigV4 test-suite readme containing a sample base64 STS session token from AWS documentation; it is a documented example value, not an encoded payload.
-
, , )likely benign Expected HMAC-SHA256 signature literal in a signer unit test.Reasoning
Expected HMAC signature base64 string in a signing unit test; this is an expected test vector, not obfuscation.
-
, , )likely benign Expected signature value asserted in a signer test.Reasoning
Assertion comparing a computed signature against a known base64 value in a test file; legitimate test vector.
-
: , : , } =likely benign Fixture signature value in a signer test.Reasoning
Signature fixture in a test dictionary for signing logic; benign test data.
-
, , )likely benign Expected signature tuple in a signer test.Reasoning
Expected signature tuple in a signer unit test; benign test vector.
-
, , )likely benign Expected signature assertion in a signer test.Reasoning
Asserted expected signature value in a test of request signing; benign.
-
), )likely benign Expected signature string in an auth test.Reasoning
Expected signature in a presigned/auth header test string; benign test data.
-
: , : , :likely benign Base64 bearer token fixture in an auth unit test.Reasoning
The token decodes to a plain-English joke string used as a bearer token fixture in a unit test; test data with no malicious execution path.
-
: , },likely benign Expected Authorization header base64 fixture in a test.Reasoning
Same base64 bearer token fixture repeated as expected Authorization header in the test; benign.
-
=likely benign Gzip-compressed binary fixture in a compression test.Reasoning
A gzip-compressed request body captured as a bytes literal for a compression test; this is an expected binary fixture, a legitimate pattern in test suites.
-
likely benign Binary eventstream frame fixture in a test.
Reasoning
Binary event-stream frame encoded as bytes literal for a parsing test; expected protocol fixture.
-
=likely benign Binary eventstream headers fixture in a test.Reasoning
Binary headers encoding fixture for eventstream tests; legitimate protocol test data.
-
, ,likely benign Expected checksum digest values in an httpchecksum test.Reasoning
Expected base64 checksum digests for SHA1/SHA256/SHA512 in a checksum test table; benign test vectors.
-
, , ), ]likely benign Expected SHA512 digest value in an httpchecksum test.Reasoning
Expected SHA512 base64 digest in the same checksum test table; benign.
-
= =likely benign A base64-encoded pagination token string used as test input for a paginate unit test.Reasoning
Raw-pass base64 signal on a pagination token in a unit test. The blob decodes to JSON with boto_encoded_keys and a base64 value (YmFy = b'bar'), which matches the test's expected result. This is a test fixture for a pagination token codec, not obfuscation or a payload.
-
=likely benign A multi-part base64 pagination token constructed in a unit test for paginate decoding.Reasoning
The split base64 string is a multi-line pagination token fixture. It decodes to structured JSON (boto_encoded_keys and nested bytes values) that the test checks against an expected dict. Raw-pass base64 hits on test fixtures are a known false-positive pattern.
-
=likely benign A split base64 pagination token fixture used to test nested-key decoding.Reasoning
Another concatenated base64 pagination token fixture in a test file. It decodes to JSON with boto_encoded_keys and base64-encoded bytes values, consistent with the expected output in the test. No execution or hidden payload is involved.
-
) =likely benign The continuation of a base64 pagination token fixture in a paginate unit test.Reasoning
The continuation of the same multi-line pagination token fixture. The decoded content is ordinary JSON test data matching the expected dict on the following line. The raw base64 heuristic fires on legitimate test data here.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&