disclude.iocelery 5.7.0rc1
- Source
- https://github.com/celery/celery
- Tag scanned
v5.7.0rc1- Compared with
v5.7.0b1(0 signals introduced since)- Files
- 775 scanned, 47 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 40 info
- Scan time
- 31.9 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 33 of 33 warn and critical signals; 33 demoted to info.
- Disclude version
- 4.1.0
- Scanned (UTC)
- 2026-10-22 09:06
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
likely benign A base64-encoded PGP public key block in the contributing guide.
Reasoning
The blob starts with the standard RSA public key packet header of an OpenPGP key block, which is the expected content of a contributor guide listing a signing key. Raw-pass base64 matches on such material are a known false-positive pattern.
-
return =likely benign An opt-in-looking import-tracing wrapper around builtins.__import__ in the package init.Reasoning
Replacing builtins.__import__ is a powerful, process-wide change and would be alarming in most code. Here it wraps the real import in a debug_import helper that logs and delegates, which reads as an opt-in import-tracing debug feature. The snippet does not show the gating condition, so some doubt remains.
-
""" frame, level = sys._getframe(1), 1 while frame is not None and frame_is_celery(frame): frame, level = frame.f_back, level + 1likely benign Stack-frame walk used to locate the first non-Celery caller.Reasoning
Walking sys._getframe up the stack to skip Celery's own frames is a standard way to find the calling module for default app naming. It has no network, file, or execution side effects.
-
"""Method that is called on сhord header stamping start. Arguments: -
"""Method that is called on сhord header stamping start. Arguments: -
"""Method that is called on сhord header stamping end. Arguments: -
"""Method that is called on сhord header stamping end. Arguments: -
# this raises a BdbQuit exception that we're unable to catch.likely benign Clears the trace function at the end of a remote debugging session.Reasoning
This is the remote debugger module, and sys.settrace(None) is the normal way to stop tracing when the debugging session ends. It is expected behaviour for this module.
-
=likely benign Lazy submodule import driven by an internal origin map.Reasoning
The __import__ target comes from an internal lazy-loading map (_object_origins) built from the package's own declared module names, which is the standard lazy-import pattern. The argument is not attacker-controlled input.
-
in : # pragma: no cover = returnlikely benign Lazy direct-module import driven by an internal map.Reasoning
Same lazy-loading mechanism as the sibling finding, resolving names from the internal _direct map of the package's own modules. Nothing in the snippet indicates external input.
-
# Tasks are rarely, if ever, created at runtime - exec here is fine. = =likely benign exec of a generated function definition to produce a task with a matching signature.Reasoning
The comment and surrounding code indicate exec is used to generate a function with a matching signature from a definition string built inside the library, not from external input. The snippet is a legitimate code-generation pattern, though exec on a string always merits a look.
-
likely benign Decompresses and unpickles persisted revoked-task state.
Reasoning
The zlib-decompressed payload is revoked-task state read back from Celery's own persisted store, and the pickle loads is the library's internal serialization. Pickle on untrusted data is a risk, but nothing here shows a hidden or attacker-supplied payload.
-
AZUREBLOCKBLOB_URL: azureblockblob://DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://azurite:10000/devstoreaccount1; PYTHONPATH: /home/developer/celery tty: truelikely benign Azurite local-emulator connection string with its public default account key.Reasoning
The AccountKey is the well-known public Azurite emulator development key, and the endpoint points at a local dev container. It is a documented default, not a real credential.
-
exec "$@"likely benign Docker entrypoint that execs the passed command.Reasoning
exec "$@" is the standard Docker entrypoint idiom that replaces the shell with the container command. The arguments come from the image's own CMD or the operator.
-
likely benign A changelog link label using a Greek omega in a project name.
Reasoning
The identifier is the project name C-omega written with a Greek omega in link text in a changelog. It is a documentation typo or stylistic choice, with no code or execution context.
-
_config_sanity "$EXTRA_CONFIG" . "$EXTRA_CONFIG" filikely benign Init script sources an administrator-configured extra config file.Reasoning
Sourcing a configuration file named by a variable is the normal pattern for init scripts, and it runs only after an existing sanity check. The path comes from the administrator's environment setup, not from remote input.
-
_chuid () { ${CELERYBEAT_SU} ${CELERYBEAT_SU_ARGS} \ "$CELERYBEAT_USER" -c "$CELERYBEAT $*" } -
echo "Using config script: $CELERY_DEFAULTS" . "$CELERY_DEFAULTS" filikely benign Init script sources the operator-configured defaults file.Reasoning
Sourcing the CELERY_DEFAULTS config file is the standard init-script behaviour for loading operator settings. The path is set by the administrator.
-
# note: multi < 3.1.14 output to stderr, not stdout, hence the redirect. ${CELERYD_MULTI} expand "${CELERYD_PID_FILE}" ${CELERYD_NODES} 2>&1 } -
_chuid () { ${CELERYD_SU} ${CELERYD_SU_ARGS} "$CELERYD_USER" -c "$CELERYD_MULTI $*" } -
=likely benign Unit test exec of a literal function definition in a test namespace.Reasoning
This is a unit test that execs a fixed, literal function definition with a test namespace. The exec is a test fixture for signature handling, not a payload stage.
-
=likely benign Test helper capturing the current frame for a traceback assertion.Reasoning
This is a unit test that records the current frame's repr to check traceback or frame handling. inspect.currentframe is ordinary in test code and has no side effects.
-
= yieldlikely benign Test fixture temporarily replaces builtins.__import__ with a custom import hook.Reasoning
The assignment swaps builtins.__import__ for a test hook inside a fixture that yields, and the finally block at line 413 restores the real import. This is a common test-isolation pattern for simulating import failures, not a persistent or malicious patch.
-
=likely benign Finally block restores the original builtins.__import__ after the test fixture yields.Reasoning
This is the restore step of the same fixture, reinstating the saved realimport in a finally block. It undoes the temporary patch and is benign test cleanup.
-
=likely benign Embedded RSA private key PEM fixture used by security tests.Reasoning
The blob is a PEM-encoded RSA private key in a Celery security test module. Base64 signal on PEM armor is expected, and the key is a test fixture used to exercise the security serializer, not a live credential or payload.
-
=likely benign Embedded encrypted private key PEM test fixture.Reasoning
This is an encrypted private key PEM fixture in a test module for Celery security. The base64 content is the expected body of a PEM structure, so it is test data rather than obfuscated payload.
-
=likely benign Second embedded RSA private key PEM test fixture.Reasoning
Second RSA private key PEM fixture in the same security test module. It is a standard test key whose base64 body is expected for PEM content.
-
=likely benign Second embedded encrypted private key PEM test fixture.Reasoning
Second encrypted private key PEM fixture in the test module. The base64 body is the normal encoding of PEM data used for testing.
-
=likely benign Embedded X.509 certificate PEM test fixture.Reasoning
A PEM certificate fixture in a security test module. Certificates are base64 by design, and this is test data for certificate handling.
-
=likely benign Second embedded X.509 certificate PEM test fixture.Reasoning
Another PEM certificate fixture in the same test module. The base64 encoding is standard for certificates and carries no hidden logic.
-
=likely benign Embedded ECDSA certificate PEM test fixture.Reasoning
An ECDSA certificate PEM fixture used for security tests. Base64 content is expected for certificate PEM and is not an obfuscated payload.
-
----- ----- ++3TwpfNza+2Vn8d7oAoGCCqGSM49 / +3xcv6Sw5ny9A==likely benign Embedded EC private key PEM test fixture.Reasoning
An EC private key PEM fixture in the security test module. The base64 is the normal PEM body for test key material.
-
=likely benign Test temporarily overrides builtins.__import__ to simulate a missing dependency.Reasoning
Within a test method, builtins.__import__ is temporarily set to import_hook to force an ImproperlyConfigured path, then restored at line 169. This is ordinary test mocking of the import system.
-
=likely benign Restores the original builtins.__import__ after the security test.Reasoning
This restores builtins.__import__ to the saved _import after the test's exception check, completing the temporary mock. It is benign test cleanup.
-
=likely benign Test helper reads the current stack frame's repr to verify traceback output.Reasoning
inspect.currentframe is used inside a dummy function in a tracing test to record the frame repr for assertions about traceback behavior. Frame inspection here is a debugging or test technique, not evasion.
-
) =likely benign Test executes dynamically built function source to exercise head_from_fun.Reasoning
The exec call runs source text that the test itself builds from a literal template to create a function for head_from_fun testing. The input is test-controlled, not attacker-supplied data, so this is a legitimate testing pattern.
-
) =likely benign Test helper that exec-compiles a generated Python function definition to check argument-hint introspection.Reasoning
The exec runs a function source string built inside the test with an empty globals dict and a local namespace, then reads back the defined function. The snippet and the file name fit a unit test for head_from_fun, which needs functions with specific signatures. The source is generated by the test itself, not fetched or decoded from an external source.
-
) =likely benign Test code that exec-defines a function with keyword arguments to verify kwargs handling.Reasoning
Same pattern as the other finding in this file: exec of a locally built function source string into a local dict, then retrieval of the defined function. This is a standard way to create functions with particular signatures for testing argument introspection.
-
) = =likely benign Test code that exec-defines a function with required kwargs to check head_from_fun output.Reasoning
The exec call builds a function with required keyword-only arguments from a test-constructed string and passes it to head_from_fun. The context is clearly a unit test of signature handling, with no network input, decoding, or shell involvement.
-
assert = assert =likely benign Test that decompresses and unpickles revoked-task state read back from the worker's persistent store.Reasoning
The payload comes from the test's own persistence db (zrevoked key) and is decompressed and unpickled in a test asserting revoked-task state round-trips. Pickle and compression are the expected mechanisms for this celery worker state store, and the data is produced by the test itself, not an attacker-supplied blob.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&