disclude.ioPyPI / hypothesis / 6.170.2
hypothesis 6.170.2
- Source
- https://github.com/HypothesisWorks/hypothesis
- Tag scanned
v6.170.2- Directory
hypothesis- Compared with
v6.170.1(0 signals introduced since)- Files
- 537 scanned, 16 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 107 info
- Scan time
- 32.5 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 47 of 47 warn and critical signals; 47 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-20 00:56
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
= = =likely benign Docs config execs the project's own version.py to read __version__.Reasoning
The exec reads version.py from the project's own source tree via a path joined from root and executes it into a dict to extract __version__. This is a common Sphinx docs idiom for single-sourcing the version; the content is the project's own file, not attacker-controlled network or encoded data. Flagged as critical by the scanner, but the context is benign.
-
-
# Run all the no-extra-dependency tests for this version (except slow nocover tests) # Run tests for each extra module while the requirements are installed -
-
-
-
-
-
-
-
-
# Run some tests without docstrings or assertions, to catch bugs -
# like issue #822 in one of the test decorators. See also #1541. PYTHONOPTIMIZE=2 -
-
-
-
# like issue #822 in one of the test decorators. See also #1541. PYTHONOPTIMIZE=2 -
-
-
-
-
-
if [; then -
-
-
-
if [ ; then -
-
-
# ...but running twice takes time, don't overdo it -
# ...but running twice takes time, don't overdo it else -
else fi -
) = =likely benign Uses currentframe to report the calling location for reject().Reasoning
inspect.currentframe is used to locate the caller for error messages in reject(). This is standard library introspection for diagnostics in a testing library, not malicious.
-
= =likely benign Uses currentframe to report the calling location for assume().Reasoning
Same pattern as reject(): currentframe feeds _calling_function_location for assume() diagnostics. Legitimate use in a testing framework.
-
=likely benign Decompresses a versioned reproduction blob for Hypothesis failure replay.Reasoning
This is zlib decompression of a blob with a version byte prefix, inside a try block catching zlib.error, in the context of decoding a reproduction blob (the Hypothesis @reproduce_failure feature). It is a legitimate serialization format, not a hidden dropper; the decoded data is then parsed as a choice sequence, not executed.
-
likely benign Syntax-checks a repr of a parameter default during code generation.
Reasoning
compile is used to validate that repr of a strategy default is a syntactically valid expression, with SyntaxError suppressed. It is a syntax check on generated repr text for code generation, not execution of untrusted input.
-
= # Finally, try to work out the imports we need for builds(), .map(), # .filter(), and .flatmap() to work without NameErrorlikely benign Syntax-checks a generated expression string in the ghostwriter tool.Reasoning
compile(r, '<string>', 'eval') validates a generated source expression for the ghostwriter tool, only checking syntax. No execution occurs.
-
# executed; so you still shouldn't ghostwrite for hostile code. =likely benign Syntax-checks a repr of an identity value during ghostwriting.Reasoning
compile(repr(identity), ..., 'exec') is a syntax validity check on a repr string with SyntaxError handled. The comment in context acknowledges hostile code concerns elsewhere; this does not execute the code.
-
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# assuming a != 1 and using the definition # S(m) := aᵐ⁺¹ - 1. # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/conjecture/junkdrawer.py:316:13""" frame = sys._getframe(2) size = 1 while frame:likely benign Walks stack frames via sys._getframe to compute a size helper.Reasoning
sys._getframe(2) walks the stack to compute a size or depth for a utility routine. Standard introspection in a property-testing library.
-
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# ligatures , # emoticons , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
# stack frames up. = = = flikely benign Reads caller frame file and line to describe a coverage target.Reasoning
sys._getframe is used to label coverage/observability entries with the caller's file and line. Diagnostic introspection, benign.
-
info
warn→ info by reviewdynamic-executionhypothesis/src/hypothesis/internal/lambda_sources.py:265:20=likely benign Evals reconstructed lambda source to rebuild a function object for reflection.Reasoning
eval of a reconstructed lambda source string with the module's globals is how Hypothesis recovers lambda objects for repr and reflection. The source comes from the function's own code and the user's test definitions, so this is an expected reflective pattern, though eval is inherently risky.
-
info
warn→ info by reviewdynamic-executionhypothesis/src/hypothesis/internal/lambda_sources.py:298:9) =likely benign Execs generated source to reconstruct a lambda with closure variables.Reasoning
exec of a generated construct-lambda string rebuilds a closure with free variables. The string is built internally from the function's own source and closure names, so this is a legitimate reflection technique rather than a dropper.
-
assert = returnlikely benign Execs recorded function source into a module dict for reflection.Reasoning
exec of source into a result module dict is the mechanism used to materialize a function from its recorded source for reflection, with caching. The source originates from the library's own reflection of existing code, not from an external payload.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/scrutineer.py:114:13# pragma: no cover # only on Python < 3.12 returnlikely benign Installs a trace function to observe execution during scrutiny.Reasoning
sys.settrace installs a tracer for coverage/scrutiny of the test under execution, guarded for Python versions lacking sys.monitoring. A standard profiling technique in a testing library.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/scrutineer.py:137:13# pragma: no cover # only on Python < 3.12 returnlikely benign Removes the trace function installed for scrutiny.Reasoning
Paired sys.settrace(None) removing the tracer installed earlier. Same benign profiling context.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/strategies/_internal/strategies.py:102:31return : | None = =likely benign Call-stack walk to find the user's source location for strategy reporting.Reasoning
sys._getframe(1) walks up past Hypothesis's own files to locate the user's calling code for reporting. This is a standard, legitimate use in a testing library and does not execute anything.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/strategies/_internal/types.py:227:37: | None = None : | None = = flikely benign Frame walk recording caller file and line for diagnostics.Reasoning
sys._getframe() walks frames to record file and line locations for type-resolution diagnostics. It is read-only introspection with no dropper or obfuscation behaviour.
-
info
critical→ info by reviewdynamic-executionhypothesis/tests/codemods/test_codemod_cli.py:40:12returnlikely benign Test helper running CLI command strings through the shell.Reasoning
A small test helper wraps subprocess.run with shell=True so tests can run CLI command strings. The command comes from test code, not untrusted input, so this is a test convenience rather than an attack.
-
info
warn→ info by reviewframe-introspectionhypothesis/tests/conjecture/test_junkdrawer.py:201:16assert ==likely benign Test asserting stack depth via inspect.stack.Reasoning
inspect.stack(0) is used in a test to check that the stack depth matches the caller's. It is a plain test assertion on stack structure.
-
assert not = assert assert notlikely benign Round-trip repr test for FeatureFlags via eval.Reasoning
eval(repr(flags)) is a round-trip test checking that the FeatureFlags repr reconstructs an equivalent object. The input is the library's own repr output.
-
=likely benign Repr round-trip test for feature flags.Reasoning
Same round-trip pattern: eval of the object's own repr in a unit test to confirm serialization fidelity.
-
# the line `offset` lines below the `def` statement of the calling function = . return flikely benign Test computing an expected caller file and line.Reasoning
inspect.currentframe().f_back reads the caller's line number so the test can compute an expected source location. Benign test introspection.
-
]: = assert == assert ==likely benign Round-trip test that evals pretty-printed regex.Reasoning
eval of pretty-printed regex output inside a round-trip test to confirm the pretty printer produces valid, equivalent code.
-
assert ==likely benign Test evaluating a float repr in a restricted namespace.Reasoning
eval of a repr string with a restricted namespace in a float-round-trip test. It evaluates known repr output in a test, not untrusted data.
-
assert ==likely benign Parametrised test evaluating enum source strings.Reasoning
Test evaluating the rep parameter, a fixed parametrised string of enum source code, to check pretty-printing round-trips.
-
assert == f # hexadecimal with underscores assert ==likely benign Test evaluating a formatted hex literal back to its value.Reasoning
eval(got) checks that a formatted hex-with-underscores literal evaluates back to the original value. It is a test assertion on a known literal.
-
info
warn→ info by reviewdecoder-import-with-exechypothesis/tests/cover/test_reproduce_failure.py:146:20= = =likely benign Test decoding and evaluating a reproduction blob from failure notes.Reasoning
The file imports base64 and zlib alongside eval. This is Hypothesis's reproduce_failure decode path: it regex-extracts a reproduction expression from the test's own notes and evals it. The decoder-plus-exec shape is real, but it appears in a test verifying the library's own feature, so it is most likely benign.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/cover/test_reproduce_failure.py:146:20= = =likely benign Eval of the regex-extracted reproduction expression.Reasoning
The eval is applied to a regex match of the library's own reproduction expression. That is the same benign path as the decoder-import finding, so it is most likely benign.
-
-
-
= = -
= = -
= = -
= = -
= = -
= = -
= = -
= = -
info
warn→ info by reviewunicode-mixed-scripthypothesis/tests/cover/test_unicode_identifiers.py:37:1= == 3.1415likely benign Intentional unicode identifier in a unicode-handling test.Reasoning
A Greek π identifier mixed with Latin letters is deliberate: the test exists to verify Hypothesis handles unicode identifiers. It is a legitimate test fixture, not obfuscation.
-
info
warn→ info by reviewunicode-mixed-scripthypothesis/tests/cover/test_unicode_identifiers.py:41:44assert ==likely benign Unicode-identifier test for lambda source descriptions.Reasoning
Same intentional mixed-script identifier, used to check source-description output for unicode lambda names.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/recorded/magic_builtins.txt:112:5eval(source, globals, locals)dismissed Eval appearing in a recorded documentation fixture.Reasoning
The file is a recorded text output fixture for ghostwriter, and the eval appears in prose or markup text, not as executed code. It is not an execution vector.
-
info
warn→ info by reviewdecoder-import-with-exechypothesis/tests/ghostwriter/test_expected_output.py:302:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign Test helper executes generated Python source to verify it compiles and runs.Reasoning
This is a Hypothesis ghostwriter test that execs generated source code in a test to check it is valid. The base64 import is incidental to the test module, and exec of generated test code is the purpose of the test.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:302:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign exec on expected source string in a ghostwriter output test.Reasoning
exec of a variable holding expected generated source in a test assertion context; no external or encoded input is involved.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:317:5assert ==likely benign Test exec of generated code with a namespace.Reasoning
Same test pattern: exec of generated code with a namespace dict to confirm it runs without NameError.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:339:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign Test exec of expected generated source.Reasoning
Same benign test pattern of executing expected generated source.
-
likely benign Test helper that execs generated code and prints it on exception.
Reasoning
Helper executes generated source inside a try block and prints it on failure; a standard test-harness pattern for checking generated code.
-
=likely benign Test execs ghostwriter-generated source.Reasoning
exec of output from ghostwriter.magic in a test; the code is generated by the library under test, not untrusted input.
-
=likely benign Test execs generated binary operation source.Reasoning
exec of ghostwriter.binary_operation output in a test to verify it runs.
-
# Most importantly: the code should execute without NameErrorlikely benign Test execs generated source to check for NameErrors.Reasoning
Test comment states the goal is that the code runs without NameError; exec of generated code is the test intent.
-
= # and also works with explicit identity element =likely benign Test execs generated binary operation code.Reasoning
Test execs output of ghostwriter.binary_operation, consistent with the rest of the test module.
-
=likely benign Test execs generated code with explicit identity.Reasoning
Same benign test pattern exec on generated binary operation source.
-
assert inlikely benign Test execs generated one_of source.Reasoning
Test execs generated source from ghostwriter.
-
= # Also cover passing an explicit `annotate`, rather than the default None. =likely benign Test execs generated ufunc source.Reasoning
Test execs ghostwriter.ufunc output; benign test verification.
-
=likely benign Test execs generated ufunc source with annotate.Reasoning
Same benign ufunc test exec pattern.
-
info
critical→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_ghostwriter_cli.py:43:12returnlikely benign Test helper wrapping subprocess.run with shell=True for CLI tests.Reasoning
Test helper runs a command string with shell=True; the cmd is passed by test code controlling the CLI invocation, a common test utility, not attacker-controlled input in shipped code.
-
= = = assert ==likely benign Test evals a strategy repr to verify round-trip stability.Reasoning
Round-trip test evaluating repr output of a strategy in a controlled namespace to check repr stability; test-only code.
-
assert ==likely benign Test evals sampled transform reprs for round-trip check.Reasoning
Parametrized test evaluating repr strings of transforms; benign test code verifying repr round-trip.
-
= = =likely benign A numpy test helper calls eval on a parameter to build an array for comparing floor and ceil behavior.Reasoning
eval is called on a function parameter named value, so the expression is non-literal and dynamic execution is a real concern in general. However, the file is a test under tests/numpy, the parameter is likely supplied by pytest parametrization with literal array expressions, and the surrounding code is a plain numerical comparison of floor and ceil. This reads as a lazy test-data pattern rather than malicious execution, though the snippet cannot confirm the parameter sources.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&