disclude.iocffi 2.1.1
- Source
- https://github.com/python-cffi/cffi
- Artifact scanned
cffi-2.1.1.tar.gz- Compared with
cffi-2.1.0.tar.gz(0 signals introduced since)- Files
- 204 scanned, 18 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 31 info
- Scan time
- 26.1 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 31 of 31 warn and critical signals; 31 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-22 23:24
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
=likely benign Helper copies named attributes from the cffi lib object into module globals.Reasoning
This is cffi's standard pattern for exposing library symbols as module globals, a mechanical binding of the cffi-generated lib object to names. It is an ordinary dynamic-attribute lookup in a well-known FFI binding module, not hidden behavior.
-
= =likely benign Assigns C constant values to module globals by name during curses binding setup.Reasoning
Part of the same cffi binding setup that assigns constant names from the parsed C header into module globals. The key names come from the library's own declarations, so this is a legitimate binding technique.
-
= =likely benign Sets ACS curses symbols in module globals from lib.acs_map.Reasoning
Populates ACS character constants into module globals from the curses library's acs_map, a routine binding step. Nothing here is externally driven or obfuscated.
-
=likely benign Copies an existing global value under an alias name.Reasoning
Aliases one global name to another within the same binding table; purely internal name mapping in a demo file.
-
=likely benign Reads a global by name to alias it within the curses binding.Reasoning
Same aliasing line as the previous finding, flagged for the globals() read. No externally controlled input reaches it.
-
=likely benign Imports a dialect-specific generated CSV extension module, building it if missing.Reasoning
The import name is a fixed prefix plus a dialect name, which is the cffi demo's way of loading a generated extension module, with a fallback to building it on ImportError. The dialect is a local parameter, not network or attacker-fetched input, so the risk is low, but the non-literal import is worth noting.
-
= , = , #likely benign Retry import of the generated fastcsv dialect module after building it.Reasoning
Same generated-module import as the sibling finding, reached after building the FFI for the dialect. Standard cffi demo code with no payload or remote fetch.
-
# PKG_CONFIG_PATH = $(brew --prefix libffi)/lib/pkgconfig = =likely benign Runs brew --prefix libffi at build time to find the libffi pkgconfig directory.Reasoning
A fixed command queries the Homebrew libffi prefix so the build can locate pkg-config files. The command is a literal, and only its output is used to build a path. This is a standard build-time helper, though os.popen is a shell call.
-
; /* clear error condition */ funcptr = ; iflikely benign Looks up a named function symbol in a dynamically loaded library for cffi.Reasoning
dlsym with a caller-supplied name is the core mechanism of cffi's dlopen-based library access, where the user explicitly asks for a named symbol. It is the expected behavior of an FFI library, not an obfuscated payload.
-
; /* clear error condition */ data = ; iflikely benign Resolves a named data symbol from a loaded shared library.Reasoning
Same cffi dlsym mechanism used to resolve named global variables from a loaded library. Expected FFI behavior.
-
; /* clear error condition */ data = ; iflikely benign Resolves a named data symbol in the cffi backend, with error handling.Reasoning
Another variable lookup through dlsym in the cffi backend, identical in purpose to the neighboring finding. Legitimate FFI code.
-
handle = ; ;likely benign Opens a shared library at a user-provided path for cffi's dlopen interface.Reasoning
dlopen on a path passed by the user is the purpose of cffi's dlopen API. The surrounding code frees the path buffer and handles errors, which is ordinary library loading.
-
; /* clear error condition */ address = ; iflikely benign Looks up a requested symbol in an open library handle in cdlopen.Reasoning
Standard dlsym lookup of a requested symbol with dlerror handling in cffi's cdlopen implementation. This is the intended feature of the library.
-
return =likely benign Test helper evaluates a constructed unicode literal string to check unicode handling.Reasoning
This is a unicode-escape conversion inside a test helper's __add__, used to build u'...' literals from repr output. It is a known test idiom in cffi, and the eval input is derived only from the test's own values.
-
=likely benign Compiles and executes cffi-generated Python source to build a module namespace.Reasoning
Compiles and executes generated cffi source code in a namespace during module generation. This is the expected code-generation step of cffi, operating on the project's own generated source.
-
# # =likely benign Syntax-checks generated embedding initialization source in cffi's API.Reasoning
Compiles the generated embedding init source to check it is valid Python before storing it. This is a syntax check on cffi's own generated code, not execution of untrusted input.
-
=likely benign Builds a flag dictionary from module-level constants using globals() lookups.Reasoning
Builds the G_FLAGS dictionary by reading module-level constants via globals() with fixed key names. This is a plain constant lookup in the cffi opcode table and has no obfuscation or external input.
-
= =likely benign Evaluates a flags expression while generating Python source for a C struct.Reasoning
eval of self.flags with a fixed G_FLAGS namespace is cffi's own code generation for C flag expressions. Its input comes from the library's declarations, not untrusted data.
-
+= # Python 2.6 compatibility =likely benign Compiles Python source loaded from a file in a setuptools helper.Reasoning
compile of source read from a file the build system is already processing, executed into a namespace. This is the standard pattern for loading a generated or configuration Python file in a build helper.
-
=likely benign Executes compiled build-helper source into a namespace.Reasoning
Executes the code compiled in the preceding line, within the same build-time helper. The source is the project's own file, not attacker-controlled input.
-
= return # cannot import the package itself, give uplikely benign Dynamically imports the cffi-generated extension package.Reasoning
Imports the generated extension package named by self.ext_package, with a fallback on ImportError. This is the expected way cffi loads its own compiled module, though the critical severity reflects the dynamic import rather than any malicious payload.
-
return = .. returnlikely benign Reads the caller's filename via frame introspection to build a cache path.Reasoning
sys._getframe(2) reads the calling module's filename to locate a __pycache__ directory. This is a routine way to find the caller's location and has no exfiltration or evasion behaviour.
-
= f =likely benign Test fixture runs MSVC via a shell to compile a test DLL.Reasoning
In a test fixture, a shell=True command invokes vcvarsall and cl.exe to build a test DLL. The interpolated values are local paths and architecture strings set by the test, so this is ordinary build scripting.
-
=likely benign Test fixture compiles a shared library via a shell command with a test-controlled name.Reasoning
A shell=True cc command in a test fixture, with a filename derived from a unicode test name. Shell metacharacters could in principle appear, but the input is a fixed test constant, so the risk is confined to the test run.
-
assert == 0 assert == assert == assert ==likely benign Test evaluates a C integer literal to compare against a cffi enum value.Reasoning
eval applied to a hidden_value string from a test table, with U and L suffixes stripped, to check enum constant values. The input is a fixed test constant.
-
= # for _cffi_backend on pypy continuelikely benign Integration test imports a fixed list of modules by name.Reasoning
Imports a list of cffi modules by name in an integration test, skipping those without __file__. This is an ordinary test loop over fixed module names.
-
=likely benign Linux-only test inspects the backend's dynamic symbols with objdump.Reasoning
Test runs objdump via os.popen on the path of the cffi backend to check exported symbols. The path is the module's own file and the test is skipped off Linux.
-
likely benign Test module execs a companion test file's source at import time.
Reasoning
Module-level exec of compiled source named test_dlopen.py, presumably the sibling test file, run under unicode_literals. Unusual, but it is a fixed test-suite construct with no network, decoding or persistence.
-
likely benign Compiles a companion test file's source at module import.
Reasoning
The compile half of the same module-level exec, building code from a fixed companion test file. The same reasoning applies: it is a test-suite construct without malicious indicators.
-
assert == 0 assert == assert ==likely benign Test evaluates a C integer literal to compare against a cffi enum value.Reasoning
Same pattern as the cffi0 test: eval of a C integer literal string from a test table to check enum values. Fixed test input, no attacker-controlled data.
-
return =likely benign Test helper evals a repr-derived string to build a unicode literal.Reasoning
A test helper evals a string built from repr() with escape rewriting to create Python 2/3 unicode literals. The input is the test's own value, so eval is used for literal construction, not as an injection path.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&