google-cloud-storage 3.17.1

Source: https://github.com/googleapis/google-cloud-python
Tag scanned: google-cloud-storage-v3.17.1
Directory: packages/google-cloud-storage (only this part of the repository was scanned)
Compared with: google-cloud-storage-v3.17.0 (0 signals introduced since)
Files: 275 scanned, 21 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 14 info
Scan time: 14.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 14 of 14 warn and critical signals; 14 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 06:00

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/google-cloud-storage/cloudbuild/run_benchmark_tests.sh:79:1

`source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)
```
fi
source "${BENCH_VENV}/bin/activate"

# Check and install all dependencies into virtual environment
```
likely benign LLM, confidence 0.95 The script sources the activate file of a benchmark virtualenv.
Reasoning
Sourcing a virtualenv's bin/activate from a variable path is the standard way a CI script enters a Python venv. The path is built from a script-controlled BENCH_VENV variable, and nothing in the snippet shows attacker-controlled input.
info ~~warn~~ → info by review dynamic-attribute packages/google-cloud-storage/tests/conformance/test_conformance.py:1003:21

reach-by-name through `globals` (ast pass, confidence 0.60)
```
                    test_name = f"test-S{id}-{method_name}-{lib_func.__name__}-{i}"
                    globals()[test_name] = functools.partial(
                        run_test_case, id, m, c, lib_func, _HOST
                    )
```
likely benign LLM, confidence 0.90 Conformance test generator registers parametrized test cases by name in module globals.
Reasoning
Generating test functions into globals() with names built from service and method identifiers is a common parametrization pattern in conformance test suites. The names are test labels, not attacker-controlled code, and the value is a functools.partial over a local test runner.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:397:29

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        key = b"aa426195405adee2c8081bb9e7e74b19"
        header_key_value = "YWE0MjYxOTU0MDVhZGVlMmM4MDgxYmI5ZTdlNzRiMTk="
        header_key_hash_value = "V3Kwe46nKc3xLv96+iJ707YfZfFvlObta8TQcx2gpm0="
        BLOB_NAME = "blob-name"
```
dismissed LLM, confidence 0.95 Base64-encoded test encryption key used as an HTTP header fixture.
Reasoning
The value is base64 of the 32-character test key shown on the line above, in a unit test for customer-supplied encryption headers. It is a fixture, not a payload.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:398:34

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        header_key_value = "YWE0MjYxOTU0MDVhZGVlMmM4MDgxYmI5ZTdlNzRiMTk="
        header_key_hash_value = "V3Kwe46nKc3xLv96+iJ707YfZfFvlObta8TQcx2gpm0="
        BLOB_NAME = "blob-name"
        bucket = _Bucket()
```
dismissed LLM, confidence 0.95 Base64 key hash test fixture for encryption headers.
Reasoning
This is the base64 SHA-256 hash of the test key, matching the header-hash convention for encryption keys. It is a unit test constant with no executable role.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:2676:29

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        headers, object_metadata, new_content_type = info
        header_key_value = "W3BYd0AscEBAQWZCZnJSM3gtMmIyU0NIUiwuP1l3Uk8="
        header_key_hash_value = "G0++dxF4q5rG4o9kE8gvEKn15RH6wLm0wXV1MgAlXOg="
        with patch.object(
```
dismissed LLM, confidence 0.93 Base64 encryption key fixture in a blob unit test.
Reasoning
Base64 header key constant in a blob unit test that patches invocation headers. The value is test data.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_blob.py:2677:34

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        header_key_value = "W3BYd0AscEBAQWZCZnJSM3gtMmIyU0NIUiwuP1l3Uk8="
        header_key_hash_value = "G0++dxF4q5rG4o9kE8gvEKn15RH6wLm0wXV1MgAlXOg="
        with patch.object(
            _helpers, "_get_invocation_id", return_value=GCCL_INVOCATION_TEST_CONST
```
dismissed LLM, confidence 0.93 Base64 key hash fixture in a blob unit test.
Reasoning
Base64 key hash fixture adjacent to the one above, used for header assertions in a unit test.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:2918:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
dismissed LLM, confidence 0.96 Base64-encoded signed-upload policy JSON used as a test expectation.
Reasoning
The blob decodes to a JSON signed-URL policy (conditions, bucket, credential fields) used as the expected value in a unit test. Long base64 JSON in test fixtures is expected here.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:2958:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
dismissed LLM, confidence 0.96 Base64 signed-URL policy fixture in a client unit test.
Reasoning
Same pattern: a base64 JSON policy document serving as expected test output for a signed-URL test.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:2998:28

base64-like blob (476 bytes, compression ratio 0.72) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiZmllbGQxIjoiVmFsdWUxIn0seyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsia2V5Ijoib2JqZWN0LW5hbWUifSx7IngtZ29vZy1kYXRlIjoiMjAyMDAzMTJUMTE0NzE2WiJ9LHsieC1nb29nLWNyZWRlb
```
dismissed LLM, confidence 0.96 Base64 signed policy fixture with form fields in a client unit test.
Reasoning
Base64 JSON policy with field conditions, the expected output of a signed-policy test. Benign fixture.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:3115:28

base64-like blob (332 bytes, compression ratio 0.81) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsia2V5Ijoib2JqZWN0LW5hbWUifSx7IngtZ29vZy1kYXRlIjoiMjAyMDAzMTJUMTE0NzE2WiJ9LHsieC1nb29nLWNyZWRlbnRpYWwiOiJ0ZXN0QG1haWwuY29tLzIwMjAwMzEyL2F1dG8vc3RvcmFnZS9nb29nNF9yZXF1ZXN0In0seyJ4LWdvb2ctYWxnb3JpdGhtIjoiR09PRzQtUlNBLVNIQTI1NiJ9XSwiZXhwaXJhd
```
dismissed LLM, confidence 0.96 Base64 signed policy fixture with expiration in a client unit test.
Reasoning
Base64 JSON policy containing expiration and credential scope, used as an expected value in a unit test.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:3141:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
dismissed LLM, confidence 0.96 Base64 signed policy fixture in a client unit test.
Reasoning
Base64 JSON signed-URL policy used as the expected value of a test assertion. No execution or hiding behavior.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_client.py:3186:28

base64-like blob (448 bytes, compression ratio 0.76) (raw pass, confidence 0.60)
```
        EXPECTED_POLICY = "eyJjb25kaXRpb25zIjpbeyJidWNrZXQiOiJidWNrZXQtbmFtZSJ9LHsiYWNsIjoicHJpdmF0ZSJ9LFsic3RhcnRzLXdpdGgiLCIkQ29udGVudC1UeXBlIiwidGV4dC9wbGFpbiJdLHsiYnVja2V0IjoiYnVja2V0LW5hbWUifSx7ImtleSI6Im9iamVjdC1uYW1lIn0seyJ4LWdvb2ctZGF0ZSI6IjIwMjAwMzEyVDExNDcxNloifSx7IngtZ29vZy1jcmVkZW50aWFsIjoidGVzdEBtYWlsLmNvb
```
dismissed LLM, confidence 0.93 Base64-encoded signed-policy JSON fixture used in a unit test of the storage client.
Reasoning
The raw pass flagged a long base64 string. It decodes to a JSON signed-policy document (conditions for bucket, ACL, starts-with, and credential fields) in a unit test. This is a test fixture for policy-signing logic, not obfuscated or malicious content. The raw pass has a high false-positive rate for blobs like this.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_transfer_manager.py:1225:39

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            "X-Goog-Encryption-Algorithm": "AES256",
            "X-Goog-Encryption-Key": "YjIzZmYxMWJiYTE4N2RiOGMzNzA3N2U2YWYzYjI1Yjg=",
            "X-Goog-Encryption-Key-Sha256": "B25Y4hgVlNXDliAklsNz9ykLk7qvgqDrSbdds5iu8r4=",
            "Cache-Control": "private",
```
dismissed LLM, confidence 0.94 Test fixture containing a base64-encoded AES-256 customer encryption key for request headers.
Reasoning
The value is the base64 of a 32-byte customer-supplied encryption key placed in an X-Goog-Encryption-Key header in a test. The surrounding headers (AES256, Sha256, Cache-Control) show a standard test setup for encrypted uploads. The blob is a fixture value with no execution or dropper behaviour.
info ~~warn~~ → info by review encoding-base64 packages/google-cloud-storage/tests/unit/test_transfer_manager.py:1226:46

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
            "X-Goog-Encryption-Key": "YjIzZmYxMWJiYTE4N2RiOGMzNzA3N2U2YWYzYjI1Yjg=",
            "X-Goog-Encryption-Key-Sha256": "B25Y4hgVlNXDliAklsNz9ykLk7qvgqDrSbdds5iu8r4=",
            "Cache-Control": "private",
            "Content-Disposition": "inline",
```
dismissed LLM, confidence 0.94 Test fixture with a base64-encoded SHA-256 digest of a customer encryption key.
Reasoning
This is the SHA-256 digest of the test encryption key, sent in the X-Goog-Encryption-Key-Sha256 header alongside the key. It is a standard integrity header in a unit test of encrypted transfers, with no sign of obfuscation or malicious intent.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/googleapis/google-cloud-python google-cloud-python && cd google-cloud-python
git checkout google-cloud-storage-v3.17.1
disclude scan --severity info --diff google-cloud-storage-v3.17.0 packages/google-cloud-storage