disclude.iocelery 5.7.0rc1
- Source
- https://github.com/celery/celery
- Tag scanned
v5.7.0rc1- Compared with
v5.7.0b1(0 signals introduced since)- Files
- 771 scanned, 51 skipped (binary, oversized, or unrecognised)
- Signals
- 1 critical · 0 warn · 39 info
- Scan time
- 31.8 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 33 of 33 warn and critical signals; 32 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-19 03:26
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
return =likely benign Module-level wrapper that replaces builtins.__import__ with a debug_import tracer.Reasoning
Replacing builtins.__import__ is a global side effect and is unusual in a package __init__. The snippet suggests a debug import tracer that wraps the real import, which fits a diagnostic feature, but the gating condition is not shown.
-
likely benign Base64 block that appears to be an embedded PGP public key in CONTRIBUTING.rst.
Reasoning
The base64 blob starts with 'mQENBF', the header of an OpenPGP public key block in a contributing guide. Key material is expected there and is not a payload.
-
""" frame, level = sys._getframe(1), 1 while frame is not None and frame_is_celery(frame): frame, level = frame.f_back, level + 1likely benign Stack walk using sys._getframe to find the first non-celery caller frame.Reasoning
sys._getframe walks up the stack past celery's own frames to locate the caller's module, which is a standard way to name the app automatically.
-
"""Method that is called on сhord header stamping start. Arguments: -
"""Method that is called on сhord header stamping start. Arguments: -
"""Method that is called on сhord header stamping end. Arguments: -
"""Method that is called on сhord header stamping end. Arguments: -
# this raises a BdbQuit exception that we're unable to catch.likely benign Clears the trace function in the remote debugger after a session ends.Reasoning
This is the teardown of celery's remote debugger, which uses sys.settrace to stop tracing on exit. It is expected behaviour for a debugger.
-
=likely benign Lazy attribute loader calling __import__ on a module name from an internal mapping.Reasoning
This is a lazy-loading proxy that imports a module named by an internal mapping of object origins. The module names come from the library's own tables, not untrusted input.
-
in : # pragma: no cover = returnlikely benign Lazy direct-import helper that calls __import__ on an internal mapping value.Reasoning
Same lazy-loading mechanism as the other local.py finding, importing from the internal _direct mapping of names to modules.
-
# Tasks are rarely, if ever, created at runtime - exec here is fine. = =likely benign Executes a generated function definition in a fresh namespace to create a task object.Reasoning
The exec call builds a task from a definition string, and the comment says it is used for runtime-created tasks. This is a deliberate code-generation utility, though exec of a non-literal is a risky pattern if the input is attacker-controlled.
-
likely benign Loads legacy revoked-task state by zlib-decompressing and unpickling stored data.
Reasoning
The code decompresses and unpickles revoked-task state that the worker itself saved to its own persistence store. Pickle on a trusted local store is a known weakness but is consistent with the legacy format handling here.
-
AZUREBLOCKBLOB_URL: azureblockblob://DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://azurite:10000/devstoreaccount1; PYTHONPATH: /home/developer/celery tty: truelikely benign Connection string with the public Azurite emulator account key for local dev storage.Reasoning
The embedded key is the well-known public Azurite emulator AccountKey, which is documented and used only for local development.
-
exec "$@"likely benign Docker entrypoint that execs the container's command arguments.Reasoning
exec "$@" is the standard Docker entrypoint idiom that hands control to the container command. It is not a dropper.
-
likely benign Project name Cω, which mixes Latin and Greek letters, in a changelog reference.
Reasoning
The Greek omega in 'Cω' is part of the name of Microsoft's Cω project, cited in a changelog. This is a genuine name, not a homoglyph attack.
-
_config_sanity "$EXTRA_CONFIG" . "$EXTRA_CONFIG" filikely benign Sources the optional EXTRA_CONFIG shell file in the celerybeat init script.Reasoning
This is the standard init-script pattern of sourcing an admin-supplied config file after a sanity check. The path is set by the operator, not by remote input.
-
_chuid () { ${CELERYBEAT_SU} ${CELERYBEAT_SU_ARGS} \ "$CELERYBEAT_USER" -c "$CELERYBEAT $*" } -
echo "Using config script: $CELERY_DEFAULTS" . "$CELERY_DEFAULTS" filikely benign Sources the CELERY_DEFAULTS config file in the celeryd init script.Reasoning
Same as the celerybeat init script: it sources an operator-configured defaults file, which is conventional for Debian-style init scripts.
-
# note: multi < 3.1.14 output to stderr, not stdout, hence the redirect. ${CELERYD_MULTI} expand "${CELERYD_PID_FILE}" ${CELERYD_NODES} 2>&1 } -
_chuid () { ${CELERYD_SU} ${CELERYD_SU_ARGS} "$CELERYD_USER" -c "$CELERYD_MULTI $*" } -
=likely benign Test code that execs a small literal function definition in a test namespace.Reasoning
This is a unit test that execs a literal function definition to check signature handling. The pickle import and exec are test scaffolding, not a payload.
-
=likely benign Test helper that reads the current frame to build a string for an assertion.Reasoning
This is a unit test collecting frame repr strings for an error-path check. inspect.currentframe is used only for test assertions.
-
= yieldlikely benign Test fixture temporarily replaces builtins.__import__ with a custom import hook.Reasoning
The builtins.__import__ replacement is inside a try/yield with a finally that restores the original, which is a standard test fixture for simulating import failures. It is scoped to tests in a Celery test suite and is not persistent.
-
=likely benign Restores the original builtins.__import__ after the test fixture yields.Reasoning
This is the restore step in the finally block of the same fixture, reinstating the saved real import function. It is the cleanup half of a balanced, legitimate test-mocking pattern.
-
=likely benign Embedded PEM RSA private key used as test fixture data.Reasoning
The blob is a PEM RSA private key literal in a security serializer test module, consistent with test fixture key material. Raw-pass base64 detection has a high false-positive rate on PEM data, and nothing indicates malicious use.
-
=likely benign Embedded encrypted PEM private key used as test fixture data.Reasoning
This is an encrypted PEM private key literal in a security test module. It is test fixture material; the raw base64 heuristic flags it because PEM bodies are high-entropy base64.
-
=likely benign Second embedded PEM RSA private key used as test fixture data.Reasoning
Another RSA PRIVATE KEY PEM literal in the security test module, matching the pattern of the other test key fixtures. The base64-blob signal is a known false positive on PEM content.
-
=likely benign Second embedded encrypted PEM private key used as test fixture data.Reasoning
Encrypted PEM private key literal in the security test module, consistent with other fixture keys in the file. The high-entropy base64 flag reflects the PEM encoding, not obfuscation.
-
=likely benign Embedded X.509 certificate PEM used as test fixture data.Reasoning
A CERTIFICATE PEM literal in a test module for security/signing. Certificates are public data and the blob is ordinary base64 DER encoding.
-
=likely benign Second embedded X.509 certificate PEM used as test fixture data.Reasoning
A second X.509 certificate PEM literal in the same test module. Public certificate data encoded in base64 is expected here and is not obfuscation.
-
=likely benign Embedded ECDSA certificate PEM used as test fixture data.Reasoning
An ECDSA certificate PEM literal in a security test module. Public certificate content flagged by the raw base64 heuristic; there is no execution or decoding logic.
-
----- ----- ++3TwpfNza+2Vn8d7oAoGCCqGSM49 / +3xcv6Sw5ny9A==likely benign Embedded EC private key PEM used as test fixture data.Reasoning
A short EC PRIVATE KEY PEM literal in the security test module, consistent with the other fixtures. It is test key material with no decoding or dropper behavior.
-
=likely benign Test temporarily patches builtins.__import__ to exercise an import-failure path.Reasoning
This is the same temporary import-hook pattern used in test fixtures, followed by a pytest.raises check that exercises ImproperlyConfigured. The hook is set up for a test and is presumably restored afterward.
-
=likely benign Restores builtins.__import__ after a security test scenario.Reasoning
This restores the original builtins.__import__ after the test scenario, completing the temporary patch. It is cleanup in a test, not persistent tampering.
-
=likely benign Test helper reads the current stack frame's repr for trace testing.Reasoning
inspect.currentframe is used in a test helper to capture a frame repr for trace-formatting assertions. This is ordinary introspection in test code with no evasion or exfiltration.
-
) =likely benign Test uses exec to build a function from a locally generated source string.Reasoning
exec runs a generated function source string built in the test to construct a callable for head_from_fun testing. The source is locally constructed in a test with an empty globals dict; it is a dynamic-execution pattern but benign in this context.
-
) =likely benign Test helper that exec's a generated function definition to check signature hint extraction.Reasoning
The exec runs a string that the test builds to define a function with specific argument signatures, then reads the result from a local dict. This is a standard way to test signature introspection in a unit test. The source is a hardcoded test literal, not attacker-controlled input, and nothing in the snippet suggests exfiltration or a payload.
-
) =likely benign Test code that exec's a generated function to exercise keyword-argument introspection.Reasoning
Same pattern as the neighbouring exec calls: a locally built function source is executed in an isolated namespace so the test can inspect keyword-argument handling. The file is a unit test for functional helpers, and the exec has no network, shell, or encoded-blob behaviour.
-
) = =likely benign Test exec of a generated function with required kwargs to verify head_from_fun behaviour.Reasoning
The exec builds a function with required keyword-only arguments for a test of head_from_fun, then pulls it out of the local namespace. The input is a fixed test string, and the surrounding code is ordinary assertion-driven test logic.
-
assert = assert =likely benign Test code that decompresses and unpickles revoked-task state from its own test database.Reasoning
In a worker-state test, the code reads a value from a shelve-style database under a revoked key, decompresses it, and unpickles it to check round-tripping. The pickle data comes from the test's own persistence store, not from an external or embedded attacker payload. The pattern matches a legitimate serialization test in a task-queue library.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&