google-cloud-storage 3.17.1

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-cloud-storage-v3.17.1
Directory: packages/google-cloud-storage (only this part of the repository was scanned)
Compared with: google-cloud-storage-v3.17.0 (0 signals introduced since)
Files: 274 scanned, 22 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 14 info
Scan time: 12.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 14 of 14 warn and critical signals; 14 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 11:26

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/google-cloud-storage/cloudbuild/run_benchmark_tests.sh:79:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
fi
source "${BENCH_VENV}/bin/activate"

# Check and install all dependencies into virtual environment
```
likely benign LLM, confidence 0.90 Shell script sources the activate script of its benchmark virtualenv.
Reasoning
Sourcing a virtualenv activate script from a path built from a variable is a standard pattern for a CI build script; BENCH_VENV is a local venv directory the script itself creates, so this is not a malicious dropper.
info ~~warn~~ → info by review dynamic-attribute packages/google-cloud-storage/tests/conformance/test_conformance.py:1003:21

reach-by-name through `globals` (ast pass, confidence 0.60)
```
                    test_name = f"test-S{id}-{method_name}-{lib_func.__name__}-{i}"
                    globals()[test_name] = functools.partial(
                        run_test_case, id, m, c, lib_func, _HOST
                    )
```
likely benign LLM, confidence 0.90 Generates test case functions and registers them in module globals via a name-keyed assignment.
Reasoning
Dynamically assigning generated test functions into globals() is a common pytest/unittest parameterization technique; the names are built from test IDs and method names, not from untrusted input.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:397:29

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        key = b"aa426195405adee2c8081bb9e7e74b19"
        header_key_value = "YWE0MjYxOTU0MDVhZGVlMmM4MDgxYmI5ZTdlNzRiMTk="
        header_key_hash_value = "V3Kwe46nKc3xLv96+iJ707YfZfFvlObta8TQcx2gpm0="
        BLOB_NAME = "blob-name"
```
likely benign LLM, confidence 0.95 Base64-encoded test fixture for an encryption key header in a unit test.
Reasoning
The value is a base64 encoding of the hex key shown on the previous line (YWE0MjYxOTU0MDVhZGVlMmM4MDgxYmI5ZTdlNzRiMTk= decodes to aa426195405adee2c8081bb9e7e74b19), i.e. a test fixture for customer-supplied encryption headers, not obfuscation.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:398:34

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        header_key_value = "YWE0MjYxOTU0MDVhZGVlMmM4MDgxYmI5ZTdlNzRiMTk="
        header_key_hash_value = "V3Kwe46nKc3xLv96+iJ707YfZfFvlObta8TQcx2gpm0="
        BLOB_NAME = "blob-name"
        bucket = _Bucket()
```
likely benign LLM, confidence 0.90 Base64-encoded key hash test fixture for request headers.
Reasoning
A base64 SHA-256 hash of the key used as a test header value in a storage client unit test; it is expected test data.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:2676:29

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        headers, object_metadata, new_content_type = info
        header_key_value = "W3BYd0AscEBAQWZCZnJSM3gtMmIyU0NIUiwuP1l3Uk8="
        header_key_hash_value = "G0++dxF4q5rG4o9kE8gvEKn15RH6wLm0wXV1MgAlXOg="
        with patch.object(
```
likely benign LLM, confidence 0.90 Base64 encryption key header fixture in a blob unit test.
Reasoning
Base64 header key value in a unit test for encryption headers, paired with a matching hash constant; standard fixture data.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:2677:34

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        header_key_value = "W3BYd0AscEBAQWZCZnJSM3gtMmIyU0NIUiwuP1l3Uk8="
        header_key_hash_value = "G0++dxF4q5rG4o9kE8gvEKn15RH6wLm0wXV1MgAlXOg="
        with patch.object(
            _helpers, "_get_invocation_id", return_value=GCCL_INVOCATION_TEST_CONST
```
likely benign LLM, confidence 0.90 Base64 key hash fixture used in a mocked unit test.
Reasoning
Base64 SHA-256 key hash fixture used in a patch context in a test; expected test data with no execution of the decoded content.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:2918:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
likely benign LLM, confidence 0.92 Base64-encoded JSON policy document expected in a signed-URL test.
Reasoning
The string starts with eyJ (base64 of a JSON object) and decodes to a signed URL policy document with conditions like bucket and acl; it is a test expectation for a signed policy, not hidden code.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:2958:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
likely benign LLM, confidence 0.92 Base64-encoded JSON policy expectation in a client unit test.
Reasoning
Base64-encoded JSON policy fixture for a signed URL test; decodes to readable policy conditions and is only compared against output.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:2998:28

base64-like blob (476 bytes, compression ratio 0.72) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiZmllbGQxIjoiVmFsdWUxIn0seyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsia2V5Ijoib2JqZWN0LW5hbWUifSx7IngtZ29vZy1kYXRlIjoiMjAyMDAzMTJUMTE0NzE2WiJ9LHsieC1nb29nLWNyZWRlb
```
likely benign LLM, confidence 0.92 Base64-encoded JSON policy expectation for a signed upload test.
Reasoning
Base64 JSON policy with field and date conditions, used as an expected value in a signed-policy test; benign test data.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:3115:28

base64-like blob (332 bytes, compression ratio 0.81) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsia2V5Ijoib2JqZWN0LW5hbWUifSx7IngtZ29vZy1kYXRlIjoiMjAyMDAzMTJUMTE0NzE2WiJ9LHsieC1nb29nLWNyZWRlbnRpYWwiOiJ0ZXN0QG1haWwuY29tLzIwMjAwMzEyL2F1dG8vc3RvcmFnZS9nb29nNF9yZXF1ZXN0In0seyJ4LWdvb2ctYWxnb3JpdGhtIjoiR09PRzQtUlNBLVNIQTI1NiJ9XSwiZXhwaXJhd
```
likely benign LLM, confidence 0.92 Base64-encoded JSON policy expectation in a client unit test.
Reasoning
Base64 JSON policy fixture with algorithm and credential fields, a standard expected value in signed URL tests.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:3141:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
likely benign LLM, confidence 0.92 Base64-encoded JSON policy expectation in a signed-policy test.
Reasoning
Base64 JSON policy string matching the pattern of other expected signed-policy fixtures; no executable payload is decoded or run.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:3186:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
likely benign LLM, confidence 0.93 A base64-encoded JSON upload policy string used as an expected value in a unit test for a cloud storage client.
Reasoning
The blob is a base64-encoded JSON policy document (decodes to conditions with bucket, acl, starts-with, x-goog-date fields), which is a typical signed-upload policy fixture in a Google Cloud storage client unit test. Raw pass has a high false-positive rate for base64 test fixtures, and the content is benign test data.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_transfer_manager.py:1225:39

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            "X-Goog-Encryption-Algorithm": "AES256",
            "X-Goog-Encryption-Key": "YjIzZmYxMWJiYTE4N2RiOGMzNzA3N2U2YWYzYjI1Yjg=",
            "X-Goog-Encryption-Key-Sha256": "B25Y4hgVlNXDliAklsNz9ykLk7qvgqDrSbdds5iu8r4=",
            "Cache-Control": "private",
```
likely benign LLM, confidence 0.93 A base64-encoded dummy AES encryption key used in a transfer manager unit test header fixture.
Reasoning
The value is a base64 encryption key header in a test for customer-supplied encryption headers (X-Goog-Encryption-Key), which is an expected, legitimate fixture. Its decoded form is a plain ASCII string, consistent with a dummy test key.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_transfer_manager.py:1226:46

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            "X-Goog-Encryption-Key": "YjIzZmYxMWJiYTE4N2RiOGMzNzA3N2U2YWYzYjI1Yjg=",
            "X-Goog-Encryption-Key-Sha256": "B25Y4hgVlNXDliAklsNz9ykLk7qvgqDrSbdds5iu8r4=",
            "Cache-Control": "private",
            "Content-Disposition": "inline",
```
likely benign LLM, confidence 0.93 A base64-encoded SHA256 key digest header value used in a transfer manager unit test.
Reasoning
This is the SHA256 digest header paired with the test encryption key in a unit test fixture for encrypted transfers. Raw base64 match in a test file with expected header values is a common false positive with no obfuscation or malicious behavior.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-cloud-storage-v3.17.1
disclude scan --severity info --diff google-cloud-storage-v3.17.0 packages/google-cloud-storage