disclude.iofonttools 4.67.0
- Source
- https://github.com/fonttools/fonttools
- Tag scanned
4.67.0- Compared with
4.66.1(0 signals introduced since)- Files
- 830 scanned, 1814 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 80 info
- Scan time
- 37.4 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 36 of 36 warn and critical signals; 36 demoted to info.
- Disclude version
- 4.1.0
- Scanned (UTC)
- 2026-10-22 03:57
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
-
# The unit vector's X and Y components are respectively # U = (cos(α), sin(α)) # where α is the angle between the unit vector and the positive x axis. = # == sin(1/8 * pi) == 0.38268343236508984 -
# The unit vector's X and Y components are respectively # U = (cos(α), sin(α)) # where α is the angle between the unit vector and the positive x axis. = # == sin(1/8 * pi) == 0.38268343236508984 -
# U = (cos(α), sin(α)) # where α is the angle between the unit vector and the positive x axis. = # == sin(1/8 * pi) == 0.38268343236508984 -
= =likely benign Resolves benchmark function names from strings via globals() in a benchmark wrapper.Reasoning
Looking up benchmark function names by string through globals() is a common pattern for selecting benchmark targets from a fixed set in a developer tool. Nothing in the snippet is hidden or fetches external code.
-
= =likely benign Second globals() name lookup in the benchmark wrapper, resolving the setup function.Reasoning
Same globals() name lookup as the paired finding in the same wrapper; it selects a local benchmark function and is a benign dispatch pattern.
-
= continuelikely benign Dynamically imports fontTools submodules by name to collect their main() help entries.Reasoning
__import__ is applied to a package name from a loop over known fontTools submodules, catching ImportError to skip missing ones. The critical severity reflects the dynamic import pattern, but the context is a help-listing routine for the library's own modules.
-
= Nonelikely benign Populates module globals with stub values to emulate Cython type names in pure Python mode.Reasoning
This is the standard pure-Python fallback that stubs out Cython names such as double, complex and int by setting globals to None when Cython is unavailable. It is a well-known compatibility shim.
-
= =likely benign Assigns empty decorator stubs for Cython decorators in the pure-Python fallback.Reasoning
Assigns no-op decorator stubs into globals for cfunc and inline when Cython is absent. This is a benign compatibility shim consistent with the paired finding.
-
=likely benign Checks local arguments via locals().get to raise a ValueError on invalid argument combinations.Reasoning
Reads the local variables msg and level via locals() to validate that they are not passed without a logger. This is a plain argument check with no hidden execution.
-
pass -
-
: is or . is , -
= = + -
= =likely benign Evaluates user-supplied CLI expression strings to build symbolic functions for a pen.Reasoning
eval is applied to command-line arguments in a developer CLI that turns expression strings into pen functions. This is unsafe by design but the input is supplied locally by the user running the tool, not fetched from a remote source, so it is not an obfuscated dropper.
-
= =likely benign Resolves a benchmark function name via globals() in the qu2cu benchmark wrapper.Reasoning
Mirrors the cu2qu benchmark wrapper, using globals() to resolve benchmark function names from a fixed set. It is benign dispatch.
-
= =likely benign Resolves the setup function name via globals() in the qu2cu benchmark wrapper.Reasoning
Same globals() setup-function lookup as the other benchmark finding; benign dispatch in a benchmark harness.
-
"""Open/save fonts with TTFont() or TTCollection() ./fonttools ttLib [-oFILE] [-yNUMBER] files... -
"""Return an instance of the SFNTReader sub-class which is compatible with the input file type. -
) =likely benign Decompresses zlib-compressed WOFF font table data during parsing.Reasoning
zlib.decompress on raw table data is the standard WOFF table decompression step in a font parser. The data is font content, not an embedded hidden payload executed at runtime.
-
=likely benign Sets bitmap metric attributes from XML by name, using safeEval on the value.Reasoning
Sets attributes via vars(self) after checking the name against a fixed metric list, and parses values with safeEval. This is standard XML-to-object round-tripping in fontTools.
-
-
-
=likely benign Sets EBDT component attributes from XML by validated name, using safeEval.Reasoning
Assigns attributes via vars(self) after validating the name against known component names, with safeEval for the value. This is ordinary fontTools table deserialization.
-
-
= = =likely benign Stores sbit line metric objects on the table via vars() during binary unpacking.Reasoning
Stores line metric objects into the table object via vars() using known metric names from the format definition. This is standard structured-data handling.
-
= =likely benign Reads sbit line metric attributes via vars() when packing the table.Reasoning
Reads hori and vert metric objects back from the table via vars() for packing. The keys are fixed, so this is benign serialization code.
-
= in : =likely benign Assigns metric objects and data fields via vars() during XML parsing of the table.Reasoning
Assigns direction-keyed metric objects and data names through vars() during XML parsing, with safeEval for values. This is ordinary fontTools table code.
-
in : =likely benign Sets a whitelisted BitmapSizeTable attribute from parsed XML via vars(self).Reasoning
The vars(self) assignment is guarded by `name in dataNames`, a fixed whitelist of table attribute names, and the value goes through safeEval. This is ordinary XML-to-object deserialization in a font library.
-
=likely benign Sets a whitelisted metric attribute from XML via vars(self) when the name is in metricNames.Reasoning
The assignment is gated by `name in metricNames`, a fixed whitelist, and uses safeEval. It matches the adjacent benign XML-reading code.
-
= -
= -
<> < = => <! -
= -
-
= -
= -
-
-
= -
-
= -
= -
-
-
continuelikely benign Evaluates a per-converter condition expression from the OpenType table schema against the table's attributes.Reasoning
The eval runs conv.aux, a condition expression taken from developer-authored otData table specifications, not from font bytes. The namespace is restricted to the table's own dict.
-
continue =likely benign Evaluates a schema-defined aux condition during binary table reading.Reasoning
Same pattern: eval of a schema-defined conv.aux condition against the table dict. The input is developer-defined spec, not attacker-controlled data.
-
continuelikely benign Evaluates a schema-defined conditional field expression during table compilation.Reasoning
eval of conv.aux from the static OpenType schema, applied to the table namespace. This is the library's standard conditional-field mechanism.
-
continue =likely benign Evaluates a schema-defined aux expression against the table's attribute dict.Reasoning
eval of the static schema expression conv.aux against vars(self). The expression source is not derived from font data.
-
= =likely benign Resolves an OpenType converter class name from the schema via eval.Reasoning
The eval resolves a converter class from spec.type, which comes from the bundled otData schema. The namespace is fixed in the library, so this is class-name lookup rather than arbitrary execution.
-
= = = or inlikely benign Pre-compiles a schema-defined aux expression for later evaluation.Reasoning
compile is applied to self.aux, a schema-defined expression string, in eval mode. The source is trusted library data.
-
continue =likely benign Evaluates a schema-defined conditional expression during table compilation.Reasoning
Same schema-driven eval of conv.aux against vars(self) as in otBase. It is a standard, developer-controlled conditional mechanism.
-
= -
= -
= blikely benign A large bytes literal of octal escapes, most likely embedded binary constant data.Reasoning
The raw pass flags a long bytes literal of octal escapes, which is a binary constant table typical of embedded PostScript or glyph-program data in a font library. The snippet shows no decoding or execution, and the pass has a higher false-positive rate.
-
=likely benign Checks for deprecated verbose/quiet arguments by name via locals().get.Reasoning
locals().get is used over a fixed tuple of argument names ('verbose', 'quiet') to detect deprecated kwargs. This is a benign reflective lookup over a constant set.
-
# If pyTag is found in the ImportError message,likely benign Dynamically imports a fontTools table module named from the font's table tag.Reasoning
The import is prefixed with a fixed package path and only loads modules under fontTools.ttLib.tables, with ImportError handling for unknown tags. The tag comes from font data, but it can only reach fontTools's own table modules, so the risk is limited. It is still a dynamic import of font-supplied input, so some doubt remains.
-
-
-
) = =likely benign Runs an external diff command via os.popen in a round-trip test helper.Reasoning
This is a developer test utility that runs a diff command via os.popen. The command is built locally from paths, and exploiting it requires control of the local invocation, not a remote payload. Shell use in a dev script is not by itself malicious, but the command's construction is not shown.
-
lookup slashcontext chained⟨U+000D⟩⟨U+000D⟩RightToLeft no⟨U+000D⟩IgnoreBaseGlyphs no⟨U+000D⟩IgnoreLigatures no⟨U+000D⟩IgnoreMarks no⟨U+000D⟩⟨U+000D⟩backtrackcoverage definition begin⟨U+000D⟩zero⟨U+000D⟩one⟨U+000D⟩two⟨U+000D⟩three⟨U+000D⟩four⟨U+000D⟩five⟨U+000D⟩six⟨U+000D⟩seven⟨U+000D⟩eight⟨U+000D⟩nine⟨U+000D⟩coverage definition end⟨U+000D⟩⟨U+000D⟩inputcoverage definition begin⟨U+000D⟩slash⟨U+000D⟩coverage definition end⟨U+000D⟩⟨U+000D⟩lookaheadcoverage definition begin⟨U+000D⟩zero⟨U+000D⟩one⟨U+000D⟩two⟨U+000D⟩ -
⟨U+000D⟩lookup i-ligatures-deva context⟨U+000D⟩⟨U+000D⟩class definition begin⟨U+000D⟩ivowelsigndeva 1⟨U+000D⟩ivowelsign1deva 1⟨U+000D⟩ivowelsign2deva 1⟨U+000D⟩anusvaradeva 2⟨U+000D⟩candrabindudeva 3⟨U+000D⟩rephdeva 4⟨U+000D⟩rephanusvaradeva 5⟨U+000D⟩class definition end⟨U+000D⟩⟨U+000D⟩class 1,0,0,0,2 1,i-anusvara-deva 5,removemark-deva⟨U+000D⟩class 1,0,0,0,4 1,i-reph-deva 5,removemark-deva⟨U+000D⟩class 1,0,0,0,5 1,i-repha -
lookup slashcontext context⟨U+000D⟩⟨U+000D⟩RightToLeft no⟨U+000D⟩IgnoreBaseGlyphs no⟨U+000D⟩IgnoreLigatures no⟨U+000D⟩IgnoreMarks no⟨U+000D⟩⟨U+000D⟩coverage definition begin 0⟨U+000D⟩zero⟨U+000D⟩one⟨U+000D⟩two⟨U+000D⟩three⟨U+000D⟩four⟨U+000D⟩five⟨U+000D⟩six⟨U+000D⟩seven⟨U+000D⟩eight⟨U+000D⟩nine⟨U+000D⟩coverage definition end⟨U+000D⟩⟨U+000D⟩coverage definition begin 1⟨U+000D⟩slash⟨U+000D⟩coverage definition end⟨U+000D⟩⟨U+000D⟩coverage definition begin 2⟨U+000D⟩zero⟨U+000D⟩one⟨U+000D⟩two⟨U+000D⟩three⟨U+000D⟩four⟨U+000D⟩fiv -
lookup topmarktobase-guru mark to base⟨U+000D⟩⟨U+000D⟩mark bindigurmukhi 0 -184, 1183 16⟨U+000D⟩base ngagurmukhi 0 816, 1183 41⟨U+000D⟩base tthagurmukhi 0 816, 1183 30⟨U+000D⟩base nnagurmukhi 0 976, 1183 35⟨U+000D⟩base nagurmukhi 0 816, 1183 32⟨U+000D⟩base lagurmukhi 0 996, 1183 46⟨U+000D⟩base lanuktagurmukhi 0 996, 1183 46⟨U+000D⟩mark eematragurmukhi 0 -184, 1183 15 -
⟨U+000D⟩lookup supsToInferiors single⟨U+000D⟩⟨U+000D⟩RightToLeft no⟨U+000D⟩IgnoreBaseGlyphs no⟨U+000D⟩IgnoreLigatures no⟨U+000D⟩IgnoreMarks no⟨U+000D⟩⟨U+000D⟩y placement asuperior -560⟨U+000D⟩y placement bsuperior -560⟨U+000D⟩y placement csuperior -560⟨U+000D⟩y placement dsuperior -560⟨U+000D⟩y placement esuperior -560⟨U+000D⟩y placement fsuperior -560⟨U+000D⟩y placement gsuperior -560⟨U+000D⟩y placement hsuperior -560⟨U+000D⟩ -
lookup arabicReverse reversechained⟨U+000D⟩⟨U+000D⟩RightToLeft yes⟨U+000D⟩IgnoreBaseGlyphs no⟨U+000D⟩IgnoreLigatures no⟨U+000D⟩IgnoreMarks yes⟨U+000D⟩⟨U+000D⟩⟨U+000D⟩backtrackcoverage definition begin⟨U+000D⟩bayi1⟨U+000D⟩jeemi1⟨U+000D⟩kafi1⟨U+000D⟩ghafi1⟨U+000D⟩laami1⟨U+000D⟩kafm1⟨U+000D⟩ghafm1⟨U+000D⟩laamm1⟨U+000D⟩coverage definition end⟨U+000D⟩⟨U+000D⟩rayf2 rayf1⟨U+000D⟩reyf2 reyf1⟨U+000D⟩zayf2 zayf1⟨U+000D⟩yayf2 yayf1⟨U+000D⟩⟨U+000D⟩% subtable⟨U+000D⟩⟨U+000D⟩backtrackcoverage definition begin⟨U+000D⟩b -
, , % , )likely benign Test assertion that round-trips point data through a compile/decompile method.Reasoning
The call is compile(points), which is almost certainly the fontTools TupleVariation compile method inside a test assertion, not Python's builtin compile on dynamic code. This is a name collision with a legitimate test pattern.
-
=likely benign Test calling fontTools' compile helper on a locally built set of point indices.Reasoning
The call is to fontTools' own TupleVariation compile function, which serializes point sets to bytes. It is not Python's builtin compile on attacker input. The file is a unit test round-tripping known in-test data, with no network, shell, or dropper context.
-
likely benign Round-trip test of fontTools point-set compile/decompile with a constant empty set.
Reasoning
Same pattern as the adjacent finding: a fontTools serialization helper applied to a locally constructed set in a round-trip assertion. Nothing indicates obfuscation or hidden execution.
-
likely benign Round-trip test of fontTools delta compilation over shuffled test data.
Reasoning
The argument is a list of test deltas shuffled locally, passed to fontTools' compile for a round-trip assertion. The flagged name matches the library function, not Python's builtin compile.
-
-
-
-
likely benign Test helper that checks optional dependency availability via globals() and skips when missing.
Reasoning
The test looks up a module-level name from a fixed requirements list to check whether an optional dependency is installed, then skips if it is missing. This is a common test-harness pattern with no obfuscation or malicious payload.
-
-
= =likely benign Test executing a drawing-command snippet to populate a glyph for GLIF1 serialization checks.Reasoning
The exec runs a fixed in-repo drawing-command snippet against a local Glyph object and pointPen, which is a standard way to test glif point-pen output. It is a test fixture, not a dropper, and the code is not encoded or fetched remotely.
-
-
= =likely benign Test executing a drawing-command snippet to build a glyph for GLIF2 serialization checks.Reasoning
This mirrors the GLIF1 test: exec of a local, in-repo drawing snippet against a Glyph and pointPen for GLIF2 serialization testing. It is test scaffolding with no malicious indicators.
-
-
=likely benign Test support helper executing fixture outline code to drive a point pen.Reasoning
This is a test helper that execs the test's own outline source lines with a restricted namespace to drive a pen. The input comes from the test fixture itself, not from an external or encoded source.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&