chardet 7.6.0

Source: https://github.com/chardet/chardet
Tag scanned: 7.6.0
Compared with: 7.5.1 (20 signals introduced since)
Files: 120 scanned, 9 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 48 info
Scan time: 7.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:46

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info unicode-homoglyph scripts/substitutions.py:530:23 new in this release

identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)
```
_SERBIAN_CYRILLIC_TO_GAJ: dict[str, str] = {
    "\u0430": "a",  # а → a
    "\u0431": "b",  # б → b
    "\u0432": "v",  # в → v
```
info unicode-homoglyph scripts/substitutions.py:536:23 new in this release

identifier `е` contains homoglyph candidates: е (0435)→e (in string/comment) (raw pass, confidence 0.35)
```
    "\u0452": "đ",  # ђ → đ
    "\u0435": "e",  # е → e
    "\u0436": "ž",  # ж → ž
    "\u0437": "z",  # з → z
```
info unicode-homoglyph scripts/substitutions.py:545:23 new in this release

identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)
```
    "\u043d": "n",  # н → n
    "\u043e": "o",  # о → o
    "\u043f": "p",  # п → p
    "\u0440": "r",  # р → r
```
info unicode-homoglyph scripts/substitutions.py:547:23 new in this release

identifier `р` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)
```
    "\u043f": "p",  # п → p
    "\u0440": "r",  # р → r
    "\u0441": "s",  # с → s
    "\u0442": "t",  # т → t
```
info unicode-homoglyph scripts/substitutions.py:548:23 new in this release

identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)
```
    "\u0440": "r",  # р → r
    "\u0441": "s",  # с → s
    "\u0442": "t",  # т → t
    "\u045b": "ć",  # ћ → ć
```
info unicode-homoglyph scripts/substitutions.py:551:23 new in this release

identifier `у` contains homoglyph candidates: у (0443)→y (in string/comment) (raw pass, confidence 0.35)
```
    "\u045b": "ć",  # ћ → ć
    "\u0443": "u",  # у → u
    "\u0444": "f",  # ф → f
    "\u0445": "h",  # х → h
```
info unicode-homoglyph scripts/substitutions.py:553:23 new in this release

identifier `х` contains homoglyph candidates: х (0445)→x (in string/comment) (raw pass, confidence 0.35)
```
    "\u0444": "f",  # ф → f
    "\u0445": "h",  # х → h
    "\u0446": "c",  # ц → c
    "\u0447": "č",  # ч → č
```
info unicode-homoglyph scripts/substitutions.py:557:23 new in this release

identifier `А` contains homoglyph candidates: А (0410)→A (in string/comment) (raw pass, confidence 0.35)
```
    "\u0448": "š",  # ш → š
    "\u0410": "A",  # А → A
    "\u0411": "B",  # Б → B
    "\u0412": "V",  # В → V
```
info unicode-homoglyph scripts/substitutions.py:559:23 new in this release

identifier `В` contains homoglyph candidates: В (0412)→B (in string/comment) (raw pass, confidence 0.35)
```
    "\u0411": "B",  # Б → B
    "\u0412": "V",  # В → V
    "\u0413": "G",  # Г → G
    "\u0414": "D",  # Д → D
```
info unicode-homoglyph scripts/substitutions.py:563:23 new in this release

identifier `Е` contains homoglyph candidates: Е (0415)→E (in string/comment) (raw pass, confidence 0.35)
```
    "\u0402": "Đ",  # Ђ → Đ
    "\u0415": "E",  # Е → E
    "\u0416": "Ž",  # Ж → Ž
    "\u0417": "Z",  # З → Z
```
info unicode-homoglyph scripts/substitutions.py:568:23 new in this release

identifier `К` contains homoglyph candidates: К (041A)→K (in string/comment) (raw pass, confidence 0.35)
```
    "\u0408": "J",  # Ј → J
    "\u041a": "K",  # К → K
    "\u041b": "L",  # Л → L
    "\u041c": "M",  # М → M
```
info unicode-homoglyph scripts/substitutions.py:570:23 new in this release

identifier `М` contains homoglyph candidates: М (041C)→M (in string/comment) (raw pass, confidence 0.35)
```
    "\u041b": "L",  # Л → L
    "\u041c": "M",  # М → M
    "\u041d": "N",  # Н → N
    "\u041e": "O",  # О → O
```
info unicode-homoglyph scripts/substitutions.py:571:23 new in this release

identifier `Н` contains homoglyph candidates: Н (041D)→H (in string/comment) (raw pass, confidence 0.35)
```
    "\u041c": "M",  # М → M
    "\u041d": "N",  # Н → N
    "\u041e": "O",  # О → O
    "\u041f": "P",  # П → P
```
info unicode-homoglyph scripts/substitutions.py:572:23 new in this release

identifier `О` contains homoglyph candidates: О (041E)→O (in string/comment) (raw pass, confidence 0.35)
```
    "\u041d": "N",  # Н → N
    "\u041e": "O",  # О → O
    "\u041f": "P",  # П → P
    "\u0420": "R",  # Р → R
```
info unicode-homoglyph scripts/substitutions.py:574:23 new in this release

identifier `Р` contains homoglyph candidates: Р (0420)→P (in string/comment) (raw pass, confidence 0.35)
```
    "\u041f": "P",  # П → P
    "\u0420": "R",  # Р → R
    "\u0421": "S",  # С → S
    "\u0422": "T",  # Т → T
```
info unicode-homoglyph scripts/substitutions.py:575:23 new in this release

identifier `С` contains homoglyph candidates: С (0421)→C (in string/comment) (raw pass, confidence 0.35)
```
    "\u0420": "R",  # Р → R
    "\u0421": "S",  # С → S
    "\u0422": "T",  # Т → T
    "\u040b": "Ć",  # Ћ → Ć
```
info unicode-homoglyph scripts/substitutions.py:576:23 new in this release

identifier `Т` contains homoglyph candidates: Т (0422)→T (in string/comment) (raw pass, confidence 0.35)
```
    "\u0421": "S",  # С → S
    "\u0422": "T",  # Т → T
    "\u040b": "Ć",  # Ћ → Ć
    "\u0423": "U",  # У → U
```
info unicode-homoglyph scripts/substitutions.py:580:23 new in this release

identifier `Х` contains homoglyph candidates: Х (0425)→X (in string/comment) (raw pass, confidence 0.35)
```
    "\u0424": "F",  # Ф → F
    "\u0425": "H",  # Х → H
    "\u0426": "C",  # Ц → C
    "\u0427": "Č",  # Ч → Č
```
info unicode-homoglyph tests/test_roundtrip_short.py:55:21 new in this release

identifier `καλημέρα` contains homoglyph candidates: κ (03BA)→k, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
```
    ("cp866", "вода"),
    ("iso-8859-7", "καλημέρα"),
    ("windows-1253", "ευχαριστώ πολύ"),
    ("windows-1255", "תודה רבה"),
```

info unicode-mixed-script tests/test_roundtrip_short.py:55:21 new in this release

identifier `καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    ("cp866", "вода"),
    ("iso-8859-7", "καλημέρα"),
    ("windows-1253", "ευχαριστώ πολύ"),
    ("windows-1255", "תודה רבה"),

info ~~warn~~ → info by review payload-bytes-literal scripts/benchmark_memory.py:99:9

concatenated bytes literal contains 35 `\xNN` escapes (96% of content) — binary payload shape (ast pass, confidence 0.85)
```
    detect(
        b"\xc2\xf1\xe5 \xf1\xf7\xe0\xf1\xf2\xeb\xe8\xe2\xfb\xe5 \xf1\xe5\xec"
        b"\xfc\xe8 \xef\xee\xf5\xee\xe6\xe8 \xe4\xf0\xf3\xe3 \xed\xe0 \xe4"
        b"\xf0\xf3\xe3\xe0"
```
likely benign LLM, confidence 0.92 Cp1251-encoded Russian sample text passed to a detector in a benchmark script.
Reasoning
The bytes literal is cp1251-encoded Russian text used as input to a detect() benchmark. High-byte escapes are the expected shape for encoding test data in a charset detection library, and nothing in the snippet executes or decodes a hidden payload.

info unicode-homoglyph scripts/substitutions.py:181:28

identifier `і` contains homoglyph candidates: і (0456)→i (in string/comment) (raw pass, confidence 0.35)

    # Ukrainian/Belarusian
    "\u0456": "\u0438",  # і → и
    "\u0406": "\u0418",  # І → И
    "\u0491": "\u0433",  # ґ → г (reintroduced 1990, missing from Soviet-era CP866)

info unicode-homoglyph scripts/substitutions.py:193:35

identifier `Н` contains homoglyph candidates: Н (041D)→H (in string/comment) (raw pass, confidence 0.35)

    "\u045a": "\u043d",  # њ (NJE) → н (EN) — visual base letter
    "\u040a": "\u041d",  # Њ → Н
    "\u045b": "\u0442",  # ћ (TSHE) → т (TE) — visual base letter
    "\u040b": "\u0422",  # Ћ → Т

info unicode-homoglyph scripts/substitutions.py:195:35

identifier `Т` contains homoglyph candidates: Т (0422)→T (in string/comment) (raw pass, confidence 0.35)

    "\u045b": "\u0442",  # ћ (TSHE) → т (TE) — visual base letter
    "\u040b": "\u0422",  # Ћ → Т
    "\u045f": "\u0446",  # џ (DZHE) → ц (TSE) — visually more similar than д
    "\u040f": "\u0426",  # Џ → Ц

info unicode-homoglyph scripts/substitutions.py:202:35

identifier `К` contains homoglyph candidates: К (041A)→K (in string/comment) (raw pass, confidence 0.35)

    "\u045c": "\u043a",  # ќ (KJE) → к (KA)
    "\u040c": "\u041a",  # Ќ → К
    "\u0455": "\u0437",  # ѕ (DZE) → з (ZE) — closest sound
    "\u0405": "\u0417",  # Ѕ → З

info ~~warn~~ → info by review decoder-decompress-payload scripts/train.py:343:16

file imports decoder module(s) codecs, pickle, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        dobj = zlib.decompressobj()
        blob = dobj.decompress(data[offset:])
        if dobj.unused_data:
```
likely benign LLM, confidence 0.75 Training script that decompresses zlib-packed model data from a local file.
Reasoning
The script decompresses a zlib stream from a data file at an offset while training models. This is the expected handling of chardet's own bundled model data, and the snippet shows no network fetch, execution of the decompressed bytes, or hidden dropper behavior.
info ~~warn~~ → info by review decoder-decompress-payload src/chardet/models/__init__.py:92:14

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    expected_size = num_models * 65536
    decomp = zlib.decompressobj()
    models: dict[str, bytes] = {}
    table = bytearray()
```
likely benign LLM, confidence 0.85 Library code that inflates bundled language model tables with zlib.
Reasoning
This is the library's model loader. It builds a zlib decompressobj to expand a fixed-size table of per-language probability models, which is the normal way a compact bundled model is unpacked. The decompressed bytes are used as data, not executed.

info unicode-homoglyph tests/test_api.py:58:10

identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)

    data = (
        "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
        "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
    ).encode("iso-8859-7")

info unicode-homoglyph tests/test_api.py:58:35

identifier `η` contains homoglyph candidates: η (03B7)→n (in string/comment) (raw pass, confidence 0.35)

    data = (
        "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
        "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
    ).encode("iso-8859-7")

info unicode-homoglyph tests/test_api.py:58:66

identifier `μεγαλύτερη` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, η (03B7)→n (in string/comment) (raw pass, confidence 0.35)

    data = (
        "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
        "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
    ).encode("iso-8859-7")

info unicode-mixed-script tests/test_api.py:58:66

identifier `μεγαλύτερη` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    data = (
        "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
        "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
    ).encode("iso-8859-7")

info unicode-homoglyph tests/test_api.py:59:10

identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)

        "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
        "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
    ).encode("iso-8859-7")
    modern = chardet.detect(

info unicode-homoglyph tests/test_api.py:59:31

identifier `μακρά` contains homoglyph candidates: α (03B1)→a, κ (03BA)→k, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

        "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
        "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
    ).encode("iso-8859-7")
    modern = chardet.detect(

info unicode-mixed-script tests/test_api.py:59:31

identifier `μακρά` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

        "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
        "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
    ).encode("iso-8859-7")
    modern = chardet.detect(

info unicode-homoglyph tests/test_api.py:905:18

identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)

            (
                "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
                "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
            ).encode("iso-8859-7"),

info unicode-homoglyph tests/test_api.py:905:43

identifier `η` contains homoglyph candidates: η (03B7)→n (in string/comment) (raw pass, confidence 0.35)

            (
                "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
                "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
            ).encode("iso-8859-7"),

info unicode-homoglyph tests/test_api.py:905:74

identifier `μεγαλύτερη` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, η (03B7)→n (in string/comment) (raw pass, confidence 0.35)

            (
                "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
                "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
            ).encode("iso-8859-7"),

info unicode-mixed-script tests/test_api.py:905:74

identifier `μεγαλύτερη` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

            (
                "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
                "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
            ).encode("iso-8859-7"),

info unicode-homoglyph tests/test_api.py:906:18

identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)

                "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
                "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
            ).encode("iso-8859-7"),

info unicode-homoglyph tests/test_api.py:906:39

identifier `μακρά` contains homoglyph candidates: α (03B1)→a, κ (03BA)→k, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

                "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
                "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
            ).encode("iso-8859-7"),

info unicode-mixed-script tests/test_api.py:906:39

identifier `μακρά` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

                "Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
                "Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
            ).encode("iso-8859-7"),

info ~~warn~~ → info by review payload-bytes-literal tests/test_benchmark.py:30:5

concatenated bytes literal contains 435 `\xNN` escapes (95% of content) — binary payload shape (ast pass, confidence 0.85)
```
CYRILLIC_WIN1251 = (
    b"\xc2\xf1\xe5 \xf1\xf7\xe0\xf1\xf2\xeb\xe8\xe2\xfb\xe5 \xf1\xe5\xec"
    b"\xfc\xe8 \xef\xee\xf5\xee\xe6\xe8 \xe4\xf0\xf3\xe3 \xed\xe0 \xe4\xf0"
    b"\xf3\xe3\xe0, \xea\xe0\xe6\xe4\xe0\xff \xed\xe5\xf1\xf7\xe0\xf1\xf2"
```
likely benign LLM, confidence 0.92 Long cp1251-encoded Russian text fixture for benchmark tests.
Reasoning
The literal is a long cp1251-encoded Russian text fixture used as benchmark input. The byte-escape density reflects non-ASCII text in a non-UTF-8 encoding, which is what a charset detection test suite needs.
info ~~warn~~ → info by review encoding-base64 tests/test_escape.py:155:11

base64-like blob (64 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
```
        b"MIICpDCCAYwCCQDU+pQ4pHgSpDANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls\n"
        b"b2NhbGhvc3QwHhcNMjMwNTI5MTI0ODQ3WhcNMjQwNTI4MTI0ODQ3WjAUMRIwEAYD\n"
        b"VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+\n"
        b"7e1RRz+BI/kHMBbOz+FN5bEwMmJ2KKQGXN+yTDaj8bKRMqgJ7MJifi3eFmFnqYg\n"
```
likely benign LLM, confidence 0.90 Base64 body of a self-signed localhost PEM certificate in a test fixture.
Reasoning
The blob begins with the MIICpDCC... PEM certificate body for localhost, with BEGIN/END CERTIFICATE lines around it. Base64 certificate data in a test file is ordinary test fixture content and is not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 tests/test_escape.py:156:11

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
        b"b2NhbGhvc3QwHhcNMjMwNTI5MTI0ODQ3WhcNMjQwNTI4MTI0ODQ3WjAUMRIwEAYD\n"
        b"VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+\n"
        b"7e1RRz+BI/kHMBbOz+FN5bEwMmJ2KKQGXN+yTDaj8bKRMqgJ7MJifi3eFmFnqYg\n"
        b"-----END CERTIFICATE-----\n"
```
likely benign LLM, confidence 0.90 Further base64 lines of the same localhost PEM certificate fixture.
Reasoning
This is a continuation of the same PEM certificate fixture, ending with the END CERTIFICATE marker. It is test data for escape handling and carries no executable or malicious logic.
info ~~warn~~ → info by review payload-bytes-literal tests/test_github_issues.py:362:13

concatenated bytes literal contains 34 `\xNN` escapes (99% of content) — binary payload shape (ast pass, confidence 0.85)
```
        _assert_detection(
            b"\x841\x953"  # GB18030 encoding of U+FEFF (BOM)
            b"\xce\xd2\xc3\xbb\xd3\xd0\xc2\xf1\xd4\xb9\xa3\xac"
            b"\xb4\xe8\xc5\xe8\xb5\xc4\xd6\xbb\xca\xc7\xd2\xbb"
```
likely benign LLM, confidence 0.92 GB18030-encoded Chinese text bytes used as a regression test input.
Reasoning
The snippet is a GB18030-encoded byte fixture, with a comment naming the encoding of U+FEFF. It is a regression test input for a reported issue and matches the expected binary shape for multibyte encoding test data.

info unicode-homoglyph tests/test_statistical.py:93:6

identifier `Все` contains homoglyph candidates: В (0412)→B, с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)

_PRUNING_SAMPLES = [
    "Все счастливые семьи похожи друг на друга, каждая несчастливая семья "
    "несчастлива по-своему. Все смешалось в доме Облонских. Жена узнала, "

info unicode-homoglyph tests/test_statistical.py:94:48

identifier `Все` contains homoglyph candidates: В (0412)→B, с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)

    "несчастлива по-своему. Все смешалось в доме Облонских. Жена узнала, "
    "что муж был в связи с бывшею в их доме француженкою-гувернанткой.".encode(
        "windows-1251"

info unicode-homoglyph tests/test_statistical.py:95:41

identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)

    "несчастлива по-своему. Все смешалось в доме Облонских. Жена узнала, "
    "что муж был в связи с бывшею в их доме француженкою-гувернанткой.".encode(
        "windows-1251"
    ),

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/chardet/chardet chardet && cd chardet
git checkout 7.6.0
disclude scan --severity info --diff 7.5.1 .