disclude.iodnspython 2.9.0
- Source
- https://github.com/rthalley/dnspython
- Tag scanned
v2.9.0- Compared with
v2.8.0(16 signals introduced since)- Files
- 324 scanned, 23 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 51 info
- Scan time
- 25.0 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 41 of 41 warn and critical signals; 41 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-14 18:32
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
, )likely benign Base64 DNSSEC key/signature test fixture in dnspython-style test suite.Reasoning
Raw base64-like blob inside a DNSSEC test vector (DNSKEY/RRSIG key material in a Python test file). Legitimate test data, not obfuscation.
-
# all of this useless pointer hopping, we should get the root name. = b =likely benign Byte-string test fixture of DNS name compression pointers.Reasoning
Bytes literal of DNS compression pointers (0xC0 offsets) used to build a wire-format test input and assert its length. Expected binary test payload, not a dropper.
-
, , )likely benign Base64-encoded ECH config parameter in an SVCB DNS record test.Reasoning
This is a DNS SVCB test fixture containing an ECH (Encrypted Client Hello) config value, a legitimate base64 payload used to test parsing. It is in a tests directory of a DNS library and has no execution or dropper context.
-
, , , )likely benign Base64 HMAC-SHA512 TSIG key in a keyring test.Reasoning
A base64 TSIG HMAC key passed to a keyring constructor in a test file, which is a normal test fixture for DNS TSIG key handling.
-
, , , )likely benign Base64 HMAC-SHA256 TSIG key in a keyring test.Reasoning
A base64 HMAC-SHA256 key literal used as a test TSIG secret for keyring construction; the surrounding code is a unit test with no execution behavior.
-
, , ). }likely benign Repeated base64 TSIG key used in a keyring test.Reasoning
The same base64 HMAC-SHA512 test key appears again in a keyring test that reads back the secret; this is ordinary test fixture data.
-
, , , )likely benign Base64 TSIG key literal in another keyring test case.Reasoning
Another instance of the same test TSIG key literal in a keyring unit test, consistent with fixture data and not obfuscation.
-
-
-
-
300 300 300 -
300 300 300 -
300 300 300 -
-
-
-
likely benign A base64-encoded PGP public key block in SECURITY.md.
Reasoning
The raw pass flagged a base64 block that is a standard OpenPGP public key (the mQINBF prefix is a typical armored public key). Public key material in a security policy file is expected and carries no execution or concealment behavior. The raw pass has a higher false-positive rate.
-
# # r'\150\151\152\153\154\155\156\157\158\159' # # then it's still "all ASCII" even though the domain name has -
= =likely benign Decodes a base64 TSIG key string in the DNS TSIG module.Reasoning
The code base64-decodes a TSIG secret supplied as a string, which is ordinary key handling in the dnspython library. The signal mentions decompression, but the snippet shows only decodebytes, and nothing runs the decoded data. No dropper or dynamic execution is visible.
-
, , =, )likely benign An example base64 TSIG key used in a dnspython example script.Reasoning
This is a documentation example passing a 32-byte HMAC-SHA256 key in base64 to a TSIG constructor. Example keys like this are normal, and the blob is used only as a configuration value.
-
----- ----- +9jbfKRETywsxGN86XH/ /34jZZsqlHWbzJ2WBLY49K9mBengDLdQu5Ve9likely benign A PEM private key block in a test fixture.Reasoning
This is a PEM-armored private key in a test fixture file. Test keys are routinely committed to test suites, and the surrounding file name and structure point to DNSSEC testing. The blob is data, not hidden code.
-
=likely benign A base64 DNSKEY public key string in test data.Reasoning
The snippet is a DNSKEY string with base64 public key material in a test file. This is expected test data for DNSSEC record parsing and does not run anything.
-
----- ----- // ++// +8DV5Tup/+likely benign A PEM private key block in a test fixture.Reasoning
This is another PEM private key block in the test fixtures. Its structure and placement match other test vectors, and nothing in the snippet decodes or executes it.
-
=likely benign A base64 DNSKEY public key string in test data.Reasoning
This is a base64 DNSKEY public key in a test vector, the same pattern as other entries in the file. It is inert test data.
-
----- ----- 1iTperYVGR52zVT8ej6A9eTmmSChRANCAASfsKTiVq2KNEKSUoYtPAXiZbDG6EEP 8TwdLumK8ge2F9AtE0Q343bnnZBCFpCxuvxtuWmS8QQwAWh8PizqKrDulikely benign An EC PEM private key block in a test fixture.Reasoning
This is a PEM EC private key block in the test fixtures, with the usual ASN.1 structure visible in the base64 prefix. It is test data, and nothing decodes it at runtime in the snippet.
-
""", dnskey="256 3 13 n7Ck4latijRCklKGLTwF4mWwxuhBD/E8HS7pivIHthfQLRNEN+N2552QQhaQsbr8bblpkvEEMAFofD4s6iqw7g==", algorithm=Algorithm.ECDSAP256SHA256, ),likely benign A base64 ECDSA DNSKEY public key in test data.Reasoning
This is an ECDSA DNSKEY public key string in a test vector alongside an algorithm constant. The pattern matches legitimate DNSSEC test data.
-
----- ----- / /+//4CO4CUpzaOcqamNlikely benign An EC PEM private key block in a test fixture.Reasoning
This is a PEM EC private key block with a parameter section, typical of a test fixture. It is key material used in tests, with no concealment or execution behavior.
-
""", dnskey="256 3 14 79h90N46yGh/1ZorfUXnyKZ4fomc6cpNvf5tRCSoJJMGwNDhwpZPDbe0S/+AjuAlKc2jnKmpjegePBuvCzeMmQcjCrd8++dagfOme62HO0rjkdJu2z5V8lLDuPPvKP4V", algorithm=Algorithm.ECDSAP384SHA384, ),likely benign A base64 ECDSA P-384 DNSKEY public key in test data.Reasoning
This is an ECDSA P-384 DNSKEY public key string in a test vector next to its algorithm constant. It is standard DNSSEC test data.
-
----- ----- / ----- ----- """,likely benign Test fixture containing an Ed25519 PEM private key body.Reasoning
The blob is a PEM-encoded test private key inside a DNSSEC test fixture file; the raw pass flags base64 content that is simply the expected body of a PEM key. Test fixtures with embedded keys are a legitimate pattern, not obfuscation.
-
""", dnskey="256 3 15 iHaBu3tWzJxuuMSzk1WMwCGF3LD60n0fkOdaCCqsL0A=", algorithm=Algorithm.ED25519, ),likely benign DNSKEY public key value in a DNSSEC test fixture.Reasoning
The string is a DNSKEY public key record (base64 public key) in a test fixture for DNSSEC algorithm testing. Raw base64 flagged on a legitimate cryptographic test value.
-
----- ----- / /+/6M4wxXje5FLg== ----- -----likely benign Test fixture PEM private key spanning two base64 lines.Reasoning
Multi-line PEM private key block in a test keys module, consistent with cryptographic test data for a DNS library. Expected content for this context.
-
""", dnskey="256 3 16 ziFYQq6fEXyNKPGzq2GErJxCl9979MKNdW46r4Bqn/waS+iIAmAbaTG3klpwqJtl+Qvdj2xGqJwA", algorithm=Algorithm.ED448, ),likely benign DNSKEY public key for Ed448 in a test fixture.Reasoning
DNSKEY record with an Ed448 public key in a test fixture; base64 content is the expected payload of a DNS key record.
-
, )likely benign Base64 RRSIG signature value in DNSSEC test data.Reasoning
Base64 signature (RRSIG) data embedded in a DNSSEC test expecting a specific wire format. Raw-pass base64 heuristic on expected cryptographic test values.
-
, , ) }likely benign DNSKEY record base64 public key in a DNSSEC test.Reasoning
DNSKEY public key string in a DNSSEC test vector; base64 is the normal encoding for DNS key records.
-
, )likely benign Split base64 DNSSEC key/signature value in test data.Reasoning
Concatenated base64 signature/key continuation in a DNSSEC test fixture; legitimate test data.
-
, , ) }likely benign DNSKEY base64 public key in DNSSEC test data.Reasoning
DNSKEY public key base64 in a DNSSEC test vector, matching the surrounding test pattern.
-
, )likely benign Split base64 DNSSEC key value in test data.Reasoning
Continuation of a base64 DNSSEC key value in test fixtures; no execution or decoding of the blob occurs.
-
, )likely benign Base64 RRSIG signature value in DNSSEC test data.Reasoning
Base64 RRSIG signature data in a DNSSEC test vector for MX records; expected test payload.
-
, )likely benign Continuation of base64 RRSIG signature in DNSSEC test data.Reasoning
Duplicate-style continuation of the same RRSIG test value; legitimate test data.
-
, )likely benign Base64 RRSIG signature value in DNSSEC test data.Reasoning
Base64 RRSIG signature in a DNSSEC test vector; consistent with expected DNS signature fixtures.
-
, )likely benign Continuation of base64 RRSIG signature in DNSSEC test data.Reasoning
Continuation of the RRSIG test signature in DNSSEC fixtures; legitimate test data with no decoding or execution.
-
= =likely benign Test asserting DNS presentation-format octal escapes for labels.Reasoning
Octal escapes in a DNS name test verifying \NNN text round-tripping. Standard DNS escape syntax exercised by unit tests.
-
=likely benign Repeated octal escape round-trip assertion in DNS name tests.Reasoning
Same DNS octal escape round-trip assertion; legitimate protocol test data.
-
# raise due to interpreting arbitrary binary DNS labels as UTF-8. = =likely benign Test of DNS name unicode conversion with octal-escaped labels.Reasoning
Octal escapes used for to_unicode testing of DNS labels; legitimate test case.
-
=likely benign Assertion for octal-escaped DNS name round-trip in unicode form.Reasoning
Same unicode round-trip assertion with octal escapes; benign test code.
-
, , ), # example 2likely benign DNSKEY base64 test vector with whitespace variants.Reasoning
Base64 DNSKEY text in an rdata test fixture, with whitespace variants intentionally testing parser tolerance. Benign.
-
96Qiu6bZ31rlMQSPB20xbqJJh6psNSrQs41QvdcXAej+/ /+ =likely benign Base64 RSA public key fixture for DNS rdata parsing tests.Reasoning
Long base64 RSA key material inside a DNS rdata test vector. Expected test data.
-
likely benign Large base64 DNSKEY test vector.
Reasoning
Large base64 DNSKEY fixture in a test file; consistent with DNS test data.
-
,likely benign Base64 DNSKEY fixture for rdata tests.Reasoning
Base64 DNSKEY test fixture with intentional whitespace; benign.
-
, ), )likely benign Base64 DNSKEY test vector in rdata test suite.Reasoning
Base64 DNSKEY fixture in test_rdata.py; standard cryptographic test data.
-
+ + , )likely benign Base64 TSIG secret value in a DNS test fixture.Reasoning
The blob is a base64 encoding of the ASCII string '0123456789abcdef' repeated, used as a TSIG test secret in a test file. Raw-pass base64 detection on test fixture key material is a false positive.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&