disclude.ioPyPI / hypothesis / 6.169.2
hypothesis 6.169.2
- Source
- https://github.com/HypothesisWorks/hypothesis
- Tag scanned
v6.169.2- Directory
hypothesis- Compared with
v6.169.1(0 signals introduced since)- Files
- 536 scanned, 16 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 107 info
- Scan time
- 32.5 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 47 of 47 warn and critical signals; 47 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-15 13:41
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
= = =likely benign Docs build execs the project's own version.py to read __version__.Reasoning
exec reads the project's own version.py from a path under the repo root and runs it to extract __version__. This is a known Sphinx docs idiom; it is not obfuscated and the executed file is in-repo source, not fetched or decoded data.
-
-
# Run all the no-extra-dependency tests for this version (except slow nocover tests) # Run tests for each extra module while the requirements are installed -
-
-
-
-
-
-
-
-
# Run some tests without docstrings or assertions, to catch bugs -
# like issue #822 in one of the test decorators. See also #1541. PYTHONOPTIMIZE=2 -
-
-
-
# like issue #822 in one of the test decorators. See also #1541. PYTHONOPTIMIZE=2 -
-
-
-
-
-
if [; then -
-
-
-
if [ ; then -
-
-
# ...but running twice takes time, don't overdo it -
# ...but running twice takes time, don't overdo it else -
else fi -
) = =dismissed Uses currentframe to report where reject() was called from.Reasoning
inspect.currentframe is used to locate the caller for error messages in reject(). Standard testing-library introspection with no malicious effect.
-
= =dismissed Uses currentframe to report where assume() was called from.Reasoning
Same caller-location introspection for assume(), used for diagnostics. Benign.
-
=likely benign Decodes a base64 reproduction blob and zlib-decompresses it to replay a failure.Reasoning
zlib.decompress on a value from a user-supplied reproduction blob (the decoded[1:] after base64 decoding of a seed/blob for @reproduce_failure). This is a documented serialization format for failure replay, not a hidden payload, though it is a decoded-then-decompressed path.
-
dismissed Syntax-checks repr of a strategy default via compile.
Reasoning
compile is used only as a syntax check on repr() of a strategy for a parameter default, inside suppress(SyntaxError). It is a validation idiom, not execution of untrusted code.
-
= # Finally, try to work out the imports we need for builds(), .map(), # .filter(), and .flatmap() to work without NameErrordismissed Compiles a generated expression string to validate syntax.Reasoning
compile(r, ..., 'eval') validates a generated expression string for syntax only; it is never executed here. Benign validation.
-
# executed; so you still shouldn't ghostwrite for hostile code. =dismissed Syntax-checks a repr via compile to decide whether to emit it.Reasoning
compile(repr(identity), ..., 'exec') is a syntax check with SyntaxError fallback. The comment indicates this is about whether a repr is valid source. Benign.
-
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# assuming a != 1 and using the definition # S(m) := aᵐ⁺¹ - 1. # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/conjecture/junkdrawer.py:316:13""" frame = sys._getframe(2) size = 1 while frame:dismissed Walks the call stack via sys._getframe to measure depth.Reasoning
sys._getframe(2) is used to count stack depth for a size/diagnostic helper. Benign introspection.
-
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# ligatures , # emoticons , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
# stack frames up. = = = fdismissed Reads caller frame file and line for coverage labels.Reasoning
sys._getframe used to label coverage-collection locations by caller file and line. Benign tooling code.
-
info
warn→ info by reviewdynamic-executionhypothesis/src/hypothesis/internal/lambda_sources.py:265:20=likely benign Evaluates reconstructed lambda source to rebuild a callable for reporting.Reasoning
eval of source recovered for lambda reconstruction, used for reporting lambda source in test output. The source is derived from the user's own code under test, not attacker-controlled data, so this is an expected introspection pattern.
-
info
warn→ info by reviewdynamic-executionhypothesis/src/hypothesis/internal/lambda_sources.py:298:9) =likely benign Execs generated source to reconstruct a lambda with its free variables.Reasoning
exec of a generated construct string to rebuild a lambda with closures. It is a dynamic codegen technique within a testing library, operating on source the library itself derived from the user's code.
-
assert = returnlikely benign Execs source into a module namespace to materialize a function, with caching.Reasoning
exec of source into a fresh module dict with caching, used to rebuild functions from source for strategy/test reflection. Expected dynamic-codegen behavior for this library; the source is not fetched from an external or hidden location.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/scrutineer.py:114:13# pragma: no cover # only on Python < 3.12 returndismissed Installs a trace function for scrutineer's line tracking.Reasoning
sys.settrace installs a coverage/tracing hook in a __enter__ method, guarded for Python versions without sys.monitoring. Standard tracing for a testing tool.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/scrutineer.py:137:13# pragma: no cover # only on Python < 3.12 returndismissed Removes the trace function on scope exit.Reasoning
Pairs with the settrace install to remove the trace hook on exit. Benign.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/strategies/_internal/strategies.py:102:31return : | None = =likely benign Hypothesis uses sys._getframe to locate the caller outside its own package.Reasoning
Walks the call stack to find the first non-Hypothesis frame so error messages can point at user code. This is standard library-internal introspection with no network, file-write, or payload behaviour.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/strategies/_internal/types.py:227:37: | None = None : | None = = flikely benign Hypothesis walks the frame stack to record the location of a strategy definition.Reasoning
Walks frames to record a source location for strategy reporting. The pattern is ordinary debugging/reporting support inside a testing library.
-
info
critical→ info by reviewdynamic-executionhypothesis/tests/codemods/test_codemod_cli.py:40:12returnlikely benign Test helper invokes a CLI command through the shell via subprocess.run.Reasoning
A test helper that runs a caller-supplied command string with shell=True. This is test-harness code for invoking the codemod CLI, not a dropper or hidden execution path, though shell=True with a variable command is a generic risk pattern.
-
info
warn→ info by reviewframe-introspectionhypothesis/tests/conjecture/test_junkdrawer.py:201:16assert ==likely benign Test uses inspect.stack to verify stack depth in a recursive helper.Reasoning
Test asserting the stack depth reported by inspect.stack matches expectations in a recursive function. Purely a unit test of the junkdrawer helper.
-
assert not = assert assert notlikely benign Test evals the repr of a FeatureFlags object to check round-trip behaviour.Reasoning
Round-trips a FeatureFlags object via repr and eval to check it reconstructs correctly. The eval input is the library's own repr output within a test.
-
=likely benign Test evals the repr of feature flags for a second round-trip check.Reasoning
Same repr/eval round-trip pattern on a generated feature set. Benign test code operating on self-produced strings.
-
# the line `offset` lines below the `def` statement of the calling function = . return flikely benign Test helper reads the caller's frame to compute an expected file and line.Reasoning
Uses currentframe().f_back to compute the expected source line of a calling function for an assertion. Standard test utility.
-
]: = assert == assert ==likely benign Test evals pretty-printed regex code to verify round-tripping.Reasoning
Evals pretty-printed regex output to check it reproduces the original pattern. This is a round-trip test of the library's own output.
-
assert ==likely benign Test evals a repr string to compare float encodings.Reasoning
Evals a repr string with a restricted namespace to compare float lexicographic encodings. Test code on controlled inputs.
-
assert ==likely benign Test evals enum repr strings and checks pretty-printing reproduces them.Reasoning
Evals parametrized enum representations and checks pretty output matches. Parametrized test data, not attacker input.
-
assert == f # hexadecimal with underscores assert ==likely benign Test evals a formatted hex string to check it parses back to the original.Reasoning
Evals a formatted hexadecimal string to confirm it parses back to the original value. Benign round-trip assertion.
-
info
warn→ info by reviewdecoder-import-with-exechypothesis/tests/cover/test_reproduce_failure.py:146:20= = =likely benign Test extracts a reproduce_failure decorator from notes and evals it to replay a failure.Reasoning
Evals a reproduce_failure decorator string extracted from test notes, which is Hypothesis's own format, then calls it. The base64/zlib plus eval combination matches the flagged shape, but here it is a deliberate, documented replay feature exercised in tests, with no external payload.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/cover/test_reproduce_failure.py:146:20= = =likely benign Same eval of an extracted reproduce_failure string for replay testing.Reasoning
Same eval of a reproduction decorator extracted from notes. Part of Hypothesis's replay feature under test, not a hidden dropper.
-
-
-
= = -
= = -
= = -
= = -
= = -
= = -
= = -
= = -
info
warn→ info by reviewunicode-mixed-scripthypothesis/tests/cover/test_unicode_identifiers.py:37:1= == 3.1415dismissed Test defines a lambda with a Greek letter in its name to test Unicode identifier handling.Reasoning
A deliberately Unicode-named lambda that the test file exists to exercise. Mixed Latin and Greek is intentional test input, not obfuscation.
-
info
warn→ info by reviewunicode-mixed-scripthypothesis/tests/cover/test_unicode_identifiers.py:41:44assert ==dismissed Test references the Unicode-named lambda to check description output.Reasoning
Same intentional Unicode identifier used in a test assertion. The file's purpose is Unicode identifier support.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/recorded/magic_builtins.txt:112:5eval(source, globals, locals)dismissed Recorded ghostwriter output text contains an eval call on a string.Reasoning
A recorded prose/doc snapshot showing an eval call in ghostwriter output. Text fixture, not executed code, and the eval is a documented example.
-
info
warn→ info by reviewdecoder-import-with-exechypothesis/tests/ghostwriter/test_expected_output.py:302:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign Test asserts that generated source code executes without error via exec.Reasoning
Test file in Hypothesis ghostwriter suite; exec of generated source code to verify it is valid. The base64 import is incidental to the test module, not a decoding dropper.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:302:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign exec on expected generated source inside a unit test.Reasoning
exec of generated test expectation source in a test; the expected string is a literal test fixture, so this is a deliberate code-validity check.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:317:5assert ==likely benign exec of generated expected source in a ghostwriter test.Reasoning
Same test pattern: exec of generated expected source with a namespace for a test assertion.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:339:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign exec of generated expected source in a ghostwriter test.Reasoning
Same ghostwriter test verification pattern; no external input reaches exec.
-
likely benign Test helper execs generated code and prints it on exception.
Reasoning
Helper in test suite that execs generated source to check it runs, printing on failure. Standard test technique.
-
=likely benign Test execs ghostwriter-generated source for a socket function.Reasoning
Test executes output of ghostwriter.magic on a known module to confirm validity; no untrusted input.
-
=likely benign Test execs generated binary operation source.Reasoning
Test execs ghostwriter-generated binary_operation source; benign test verification.
-
# Most importantly: the code should execute without NameErrorlikely benign Test execs generated source to check for NameErrors.Reasoning
Test asserting generated code executes without NameError; benign.
-
= # and also works with explicit identity element =likely benign Test execs generated binary operation source.Reasoning
Benign test of generated binary_operation source.
-
=likely benign Test execs generated binary operation source with explicit identity.Reasoning
Benign test of generated binary_operation source with identity.
-
assert inlikely benign Test execs generated source containing one_of.Reasoning
Benign test executing generated source containing one_of.
-
= # Also cover passing an explicit `annotate`, rather than the default None. =likely benign Test execs ufunc-generated source.Reasoning
Benign test executing ufunc-generated source for numpy.isnan.
-
=likely benign Test execs ufunc-generated source with annotate.Reasoning
Benign test executing ufunc-generated source with annotate.
-
info
critical→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_ghostwriter_cli.py:43:12returnlikely benign Test utility running a command string through the shell.Reasoning
Test helper wrapping subprocess with shell=True for running the CLI in tests; cmd is supplied by test code, not external input. Shell=True with variable command is a common test pattern but worth noting.
-
= = = assert ==likely benign Test evals repr of a strategy to check round-trip stability.Reasoning
Test evaluating repr of Hypothesis strategies to verify round-trip; eval input is the repr of a known strategy object in a test.
-
assert ==likely benign Test evals sampled strategy repr strings.Reasoning
Parametrized test evaluating sampled strategy reprs; benign round-trip check.
-
= = =likely benign A numpy test helper calls eval on a function parameter to build an array for testing floor and ceil behavior.Reasoning
The eval call sits in a test function that takes a parameter named value and builds a numpy array from it, which is a common test-harness pattern for parametrized inputs. Test files in a numerical library rarely need eval in a sensitive way, but the eval is on a test parameter, not on network data or decoded payloads, and the snippet shows no network, encoding, or shell activity. It is a poor practice worth a note but not evidence of malicious intent.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&