google-cloud-storage 3.17.0

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-cloud-storage-v3.17.0
Directory: packages/google-cloud-storage (only this part of the repository was scanned)
Compared with: google-cloud-storage-v3.16.0 (0 signals introduced since)
Files: 274 scanned, 22 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 14 info
Scan time: 12.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 14 of 14 warn and critical signals; 14 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/google-cloud-storage/cloudbuild/run_benchmark_tests.sh:72:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
fi
source "${BENCH_VENV}/bin/activate"

# Check and install all dependencies into virtual environment
```
likely benign LLM, confidence 0.90 A CI build script sources the activate script of its benchmark virtualenv.
Reasoning
Sourcing a virtualenv activate script from a variable path is a standard CI pattern. The path is built from a build-controlled variable and nothing in the snippet suggests remote or attacker-controlled input.
info ~~warn~~ → info by review dynamic-attribute packages/google-cloud-storage/tests/conformance/test_conformance.py:1003:21

reach-by-name through `globals` (ast pass, confidence 0.60)
```
                    test_name = f"test-S{id}-{method_name}-{lib_func.__name__}-{i}"
                    globals()[test_name] = functools.partial(
                        run_test_case, id, m, c, lib_func, _HOST
                    )
```
likely benign LLM, confidence 0.85 A conformance test module registers generated test cases in globals() by name.
Reasoning
The code generates parametrized test functions by assigning functools.partial objects into globals() under names built from method and function names. This is a common test-generation idiom. It is reflective but not malicious.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:397:29

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        key = b"aa426195405adee2c8081bb9e7e74b19"
        header_key_value = "YWE0MjYxOTU0MDVhZGVlMmM4MDgxYmI5ZTdlNzRiMTk="
        header_key_hash_value = "V3Kwe46nKc3xLv96+iJ707YfZfFvlObta8TQcx2gpm0="
        BLOB_NAME = "blob-name"
```
likely benign LLM, confidence 0.90 A unit test fixture holds a base64-encoded customer encryption key header value.
Reasoning
The base64 value decodes to the hex string of the fixture key b'aa426195405adee2c8081bb9e7e74b19'. It is an encryption-key header fixture used in unit tests for customer-supplied encryption keys, with no execution or hidden payload.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:398:34

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        header_key_value = "YWE0MjYxOTU0MDVhZGVlMmM4MDgxYmI5ZTdlNzRiMTk="
        header_key_hash_value = "V3Kwe46nKc3xLv96+iJ707YfZfFvlObta8TQcx2gpm0="
        BLOB_NAME = "blob-name"
        bucket = _Bucket()
```
likely benign LLM, confidence 0.90 A unit test fixture holds the base64 key hash header value for encryption tests.
Reasoning
The base64 value is the base64 SHA-256 hash of the test encryption key, a standard header value for encrypted-blob tests. It is test data only.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:2676:29

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        headers, object_metadata, new_content_type = info
        header_key_value = "W3BYd0AscEBAQWZCZnJSM3gtMmIyU0NIUiwuP1l3Uk8="
        header_key_hash_value = "G0++dxF4q5rG4o9kE8gvEKn15RH6wLm0wXV1MgAlXOg="
        with patch.object(
```
likely benign LLM, confidence 0.88 A unit test fixture contains a base64-encoded encryption key header.
Reasoning
The value is a base64-encoded test encryption key in a unit test that patches helpers and checks encrypted-request headers. Its high-entropy look is expected for key material in tests, and the snippet contains no decoding or execution.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:2677:34

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        header_key_value = "W3BYd0AscEBAQWZCZnJSM3gtMmIyU0NIUiwuP1l3Uk8="
        header_key_hash_value = "G0++dxF4q5rG4o9kE8gvEKn15RH6wLm0wXV1MgAlXOg="
        with patch.object(
            _helpers, "_get_invocation_id", return_value=GCCL_INVOCATION_TEST_CONST
```
likely benign LLM, confidence 0.88 A unit test fixture contains the base64 key hash for the same encryption test.
Reasoning
This is the base64 SHA-256 of the test key in the same test, consistent with a legitimate encryption-header fixture. It is not used to run code.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:2918:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
likely benign LLM, confidence 0.92 A test constant holds a base64-encoded signed upload policy JSON document.
Reasoning
The string decodes to a JSON signed-URL policy document (conditions, bucket, key, expiration). It is an expected-output constant for policy-generation tests, so the base64 is just the normal encoding of a policy.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:2958:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
likely benign LLM, confidence 0.92 A test constant holds a base64-encoded signed policy JSON for comparison.
Reasoning
The value is the same kind of base64-encoded policy JSON used as an expected output in signed-policy tests. Nothing decodes and executes it.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:2998:28

base64-like blob (476 bytes, compression ratio 0.72) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiZmllbGQxIjoiVmFsdWUxIn0seyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsia2V5Ijoib2JqZWN0LW5hbWUifSx7IngtZ29vZy1kYXRlIjoiMjAyMDAzMTJUMTE0NzE2WiJ9LHsieC1nb29nLWNyZWRlb
```
likely benign LLM, confidence 0.92 A test constant holds an encoded policy document with extra form fields.
Reasoning
This base64 string decodes to a policy document with conditions and expiration fields. It is expected test output and has no execution path.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:3115:28

base64-like blob (332 bytes, compression ratio 0.81) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsia2V5Ijoib2JqZWN0LW5hbWUifSx7IngtZ29vZy1kYXRlIjoiMjAyMDAzMTJUMTE0NzE2WiJ9LHsieC1nb29nLWNyZWRlbnRpYWwiOiJ0ZXN0QG1haWwuY29tLzIwMjAwMzEyL2F1dG8vc3RvcmFnZS9nb29nNF9yZXF1ZXN0In0seyJ4LWdvb2ctYWxnb3JpdGhtIjoiR09PRzQtUlNBLVNIQTI1NiJ9XSwiZXhwaXJhd
```
likely benign LLM, confidence 0.92 A test constant holds another base64-encoded signed policy JSON.
Reasoning
This is a base64-encoded policy JSON, consistent with its neighbours. It is a fixture for policy-generation assertions in a test file.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:3141:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
likely benign LLM, confidence 0.93 Base64-encoded GCS signed-upload policy JSON used as a test expectation constant.
Reasoning
Raw-pass base64 signal on a test constant. The blob decodes to a JSON signed-URL policy document (conditions, bucket, acl, x-goog-date), which is a standard fixture in a Google Cloud Storage client test suite. Legitimate test data, not obfuscation.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:3186:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
likely benign LLM, confidence 0.93 Duplicate base64 GCS policy fixture in a second test case.
Reasoning
Same encoded policy fixture repeated in another test function in the same file. It is an expected-value constant for a signed policy test, consistent with legitimate testing.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_transfer_manager.py:1225:39

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            "X-Goog-Encryption-Algorithm": "AES256",
            "X-Goog-Encryption-Key": "YjIzZmYxMWJiYTE4N2RiOGMzNzA3N2U2YWYzYjI1Yjg=",
            "X-Goog-Encryption-Key-Sha256": "B25Y4hgVlNXDliAklsNz9ykLk7qvgqDrSbdds5iu8r4=",
            "Cache-Control": "private",
```
likely benign LLM, confidence 0.93 Base64-encoded test customer encryption key in request headers for a GCS encryption test.
Reasoning
The value is a base64 encoding of a 32-byte customer-supplied encryption key used in test headers for GCS server-side encryption (CSEK). The decoded string is a hex-like test key. Raw-pass false positive on a test fixture header value.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_transfer_manager.py:1226:46

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            "X-Goog-Encryption-Key": "YjIzZmYxMWJiYTE4N2RiOGMzNzA3N2U2YWYzYjI1Yjg=",
            "X-Goog-Encryption-Key-Sha256": "B25Y4hgVlNXDliAklsNz9ykLk7qvgqDrSbdds5iu8r4=",
            "Cache-Control": "private",
            "Content-Disposition": "inline",
```
likely benign LLM, confidence 0.93 Base64 SHA-256 digest of the test encryption key in request headers.
Reasoning
The SHA256 companion header for the test encryption key, a base64 digest string. It is a standard pairing with X-Goog-Encryption-Key in the same test dict, so it is legitimate test data.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-cloud-storage-v3.17.0
disclude scan --severity info --diff google-cloud-storage-v3.16.0 packages/google-cloud-storage