disclude.ioPyPI / hypothesis / 6.170.4
hypothesis 6.170.4
- Source
- https://github.com/HypothesisWorks/hypothesis
- Tag scanned
v6.170.4- Directory
hypothesis- Compared with
v6.170.3(0 signals introduced since)- Files
- 537 scanned, 16 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 107 info
- Scan time
- 32.5 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 47 of 47 warn and critical signals; 47 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-20 00:58
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
= = =likely benign Docs config execs the project's own version.py to read __version__.Reasoning
exec runs on the contents of the project's own src/hypothesis/version.py read from the repo's root, a standard Sphinx pattern for reading __version__ without importing the package. The expression is non-literal but comes from a fixed local path, not untrusted input. It runs only when building docs, so the risk is low but the exec of a file is worth a note.
-
-
# Run all the no-extra-dependency tests for this version (except slow nocover tests) # Run tests for each extra module while the requirements are installed -
-
-
-
-
-
-
-
-
# Run some tests without docstrings or assertions, to catch bugs -
# like issue #822 in one of the test decorators. See also #1541. PYTHONOPTIMIZE=2 -
-
-
-
# like issue #822 in one of the test decorators. See also #1541. PYTHONOPTIMIZE=2 -
-
-
-
-
-
if [; then -
-
-
-
if [ ; then -
-
-
# ...but running twice takes time, don't overdo it -
# ...but running twice takes time, don't overdo it else -
else fi -
) = =likely benign Uses frame introspection to report the calling location for reject().Reasoning
inspect.currentframe is used to locate the caller for error messages in reject(). This is ordinary diagnostic code in a testing library.
-
= =likely benign Uses frame introspection to report the calling location for assume().Reasoning
Same pattern as reject(): frame introspection to produce a location string for assume() diagnostics. Benign.
-
=likely benign Decodes and decompresses a reproduction blob for failure replay.Reasoning
zlib.decompress on a blob with a version-byte prefix is the standard decoding of Hypothesis's reproduce_failure blob format, which is user-supplied test data, not an embedded payload executed at runtime. The decompressed data is parsed as choice sequences, not executed.
-
likely benign Syntax-checks the repr of a default value to decide if it can be emitted.
Reasoning
compile is used only to check whether repr of a parameter default is valid syntax, inside a suppress(SyntaxError) block, to decide whether to include it. It is a syntax check on repr output, not execution of untrusted code.
-
= # Finally, try to work out the imports we need for builds(), .map(), # .filter(), and .flatmap() to work without NameErrorlikely benign Compiles a generated expression string only to validate its syntax.Reasoning
compile(r, ..., 'eval') validates the generated strategy expression as syntax to work out imports. It compiles but does not run the code, and the source is generated by the tool itself.
-
# executed; so you still shouldn't ghostwrite for hostile code. =likely benign Syntax-checks a repr string and falls back to repr on failure.Reasoning
compile(repr(identity), ..., 'exec') is a syntax check on a repr inside a SyntaxError handler, with the source generated by the tool. Compilation does not execute the code.
-
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# assuming a != 1 and using the definition # S(m) := aᵐ⁺¹ - 1. # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/conjecture/junkdrawer.py:316:13""" frame = sys._getframe(2) size = 1 while frame:likely benign Walks the call stack via sys._getframe to compute a frame-based size.Reasoning
sys._getframe walks the call stack to measure frame depth for a size computation. This is internal bookkeeping in a testing library, with no malicious behaviour.
-
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# ligatures , # emoticons , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
# stack frames up. = = = flikely benign Reads the caller frame's file and line for coverage descriptions.Reasoning
sys._getframe is used to read the caller's filename and line number for coverage descriptions. Routine tooling code.
-
info
warn→ info by reviewdynamic-executionhypothesis/src/hypothesis/internal/lambda_sources.py:265:20=likely benign Evals reconstructed lambda source in the function's globals.Reasoning
eval of source for a lambda being reconstructed, using the function's own globals. This is a known approach for recovering lambda objects from source in a testing library; the source comes from the user's own code under test, not from an external attacker.
-
info
warn→ info by reviewdynamic-executionhypothesis/src/hypothesis/internal/lambda_sources.py:298:9) =likely benign Execs generated source to reconstruct a lambda with its closure.Reasoning
exec of a generated constructor string to rebuild a lambda with closure variables. It is code-generation used by a testing library, operating on the user's own source; no sign of a dropper or hidden payload.
-
assert = returnlikely benign Execs source text into a module namespace to build a callable.Reasoning
exec of a source string into a result module dict, cached by source. This is the standard way Hypothesis rebuilds functions from source text for its own testing features; it does not fetch or decode external payloads.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/scrutineer.py:114:13# pragma: no cover # only on Python < 3.12 returnlikely benign Installs a trace function to analyse execution for test explanations.Reasoning
sys.settrace installs a tracer for coverage/explanation analysis during tests, guarded by a check for sys.monitoring on older Pythons. This is a legitimate debugging and tracing use.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/internal/scrutineer.py:137:13# pragma: no cover # only on Python < 3.12 returnlikely benign Removes the trace function installed by the scrutineer.Reasoning
Clears the trace function set earlier in the same tracing context. Matching teardown for the legitimate tracer.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/strategies/_internal/strategies.py:102:31return : | None = =likely benign Walks the call stack to locate the user's caller for reporting.Reasoning
sys._getframe(1) is used to walk past Hypothesis's own files to find the user's calling location for error reporting. This is a common, legitimate pattern in a testing library and does not hide any payload.
-
info
warn→ info by reviewframe-introspectionhypothesis/src/hypothesis/strategies/_internal/types.py:227:37: | None = None : | None = = flikely benign Walks frames to record a source location for a strategy.Reasoning
sys._getframe() walks frames to record a source location for strategy reporting. This is ordinary library introspection, with no network, exec, or obfuscation involved.
-
info
critical→ info by reviewdynamic-executionhypothesis/tests/codemods/test_codemod_cli.py:40:12returnlikely benign Test helper that runs a shell command string for codemod CLI tests.Reasoning
A small test helper wraps subprocess.run with shell=True so tests can run CLI command strings. The command comes from test code, not untrusted input, so the risk is limited to test tooling.
-
info
warn→ info by reviewframe-introspectionhypothesis/tests/conjecture/test_junkdrawer.py:201:16assert ==likely benign Test checking stack depth through recursive calls using inspect.stack.Reasoning
inspect.stack(0) is used in a recursion test to check that stack depth matches the caller's expectation. It is a test assertion with no malicious behavior.
-
assert not = assert assert notlikely benign Round-trips a feature-flags object through repr and eval in a test.Reasoning
eval(repr(flags)) is a round-trip serialization check on a local feature-flags object within a test. The input is the program's own repr, not external data.
-
=likely benign Round-trips feature flags through repr and eval in a test.Reasoning
Same repr/eval round-trip pattern on a locally constructed feature-flags object, testing that serialization preserves state.
-
# the line `offset` lines below the `def` statement of the calling function = . return flikely benign Test helper computing the caller's file and line via currentframe.Reasoning
inspect.currentframe().f_back is used in a test helper to compute an expected file and line number. This is benign introspection for test assertions.
-
]: = assert == assert ==likely benign Evals pretty-printed regex to verify round-trip fidelity.Reasoning
eval of pretty-printed repr output of a regex object, checked against the original pattern and flags. This is a round-trip test on locally generated data.
-
assert ==likely benign Evals a pretty-printed float representation in a round-trip test.Reasoning
eval of a pretty-printed float representation with a restricted namespace, used to check round-trip lexing. The input is generated by the library under test.
-
assert ==likely benign Evals enum representations to check pretty-printing as code.Reasoning
eval(rep) on parametrized pretty-printed enum representations in a test. The input is a fixed test parameter, not external data.
-
assert == f # hexadecimal with underscores assert ==likely benign Evals a formatted hex string to verify the round-trip value.Reasoning
eval of formatted hexadecimal output with underscores, checked against the original integer. This is a test of the formatter's output.
-
info
warn→ info by reviewdecoder-import-with-exechypothesis/tests/cover/test_reproduce_failure.py:146:20= = =likely benign Evals a reproduce_failure blob extracted from notes to rebuild a test decorator.Reasoning
The snippet is paired with a decoder-import signal because base64 and zlib are imported in the file. The eval input is a regex match on the @reproduce_failure note text in Hypothesis's own reproduction feature. It is the library's documented mechanism, not a multi-stage dropper, though an eval of extracted text is worth noting.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/cover/test_reproduce_failure.py:146:20= = =likely benign Same eval of a reproduce_failure decorator string as the paired finding.Reasoning
This is the same eval call as the preceding finding, flagged separately by the dynamic-execution signal. It operates on the library's own reproduction decorator text in a test.
-
-
-
= = -
= = -
= = -
= = -
= = -
= = -
= = -
= = -
info
warn→ info by reviewunicode-mixed-scripthypothesis/tests/cover/test_unicode_identifiers.py:37:1= == 3.1415likely benign Deliberate unicode identifier in a test of non-ASCII identifier support.Reasoning
The identifier is_approx_π deliberately mixes Latin and Greek to test unicode identifier handling in a test file. Mixed-script identifiers are intentional here and not an attack.
-
info
warn→ info by reviewunicode-mixed-scripthypothesis/tests/cover/test_unicode_identifiers.py:41:44assert ==likely benign Test referencing the deliberate unicode identifier is_approx_π.Reasoning
Same deliberate mixed-script identifier, used in a test asserting its pretty description. It is intentional test coverage for unicode names.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/recorded/magic_builtins.txt:112:5eval(source, globals, locals)dismissed Eval appears in a recorded text fixture, not as executed code.Reasoning
This is a recorded text fixture containing the string eval(source, globals, locals) in documentation prose or expected output. It is not executed code, so the dynamic-execution signal does not apply.
-
info
warn→ info by reviewdecoder-import-with-exechypothesis/tests/ghostwriter/test_expected_output.py:302:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign Test helper that execs generated Python source to verify it compiles and runs.Reasoning
This is a Hypothesis ghostwriter test that execs generated source code to check it is valid. The base64 import is incidental to the test file and the exec is on test-generated code, not a dropper pipeline.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:302:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign exec of expected generated source in a ghostwriter test.Reasoning
exec on the expected source string inside a test verifying ghostwriter output; the expected content is a fixed test fixture, so this is ordinary test validation.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:317:5assert ==likely benign exec of expected generated source in a ghostwriter test.Reasoning
Same pattern: exec of expected test-fixture source to confirm it runs without NameError, in a test module.
-
info
warn→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_expected_output.py:339:5assert == # We got the expected source code # and there are no SyntaxError or NameErrorslikely benign exec of expected generated source in a ghostwriter test.Reasoning
Same test-validation pattern of exec on expected fixture source.
-
likely benign Test helper executing generated source code and printing it on exception.
Reasoning
Helper in a test that execs ghostwriter-generated source in a namespace and prints it on failure; standard test-harness behavior.
-
=likely benign Test executes ghostwriter-generated source to check it runs.Reasoning
exec of output from ghostwriter.magic inside a test to confirm validity; no external input or network source.
-
=likely benign Test executes ghostwriter-generated binary_operation source.Reasoning
Same ghostwriter test validation of generated binary_operation source.
-
# Most importantly: the code should execute without NameErrorlikely benign Test executes generated source to check for NameError.Reasoning
Test asserts generated code executes without NameError; benign test logic.
-
= # and also works with explicit identity element =likely benign Test executes generated binary_operation source.Reasoning
Benign test of ghostwriter binary_operation output via exec.
-
=likely benign Test executes generated binary_operation source with identity argument.Reasoning
Benign test of ghostwriter binary_operation output with explicit identity.
-
assert inlikely benign Test executes generated source containing one_of.Reasoning
Benign test executing generated one_of source after asserting its content.
-
= # Also cover passing an explicit `annotate`, rather than the default None. =likely benign Test executes generated ufunc source.Reasoning
Benign test executing ghostwriter.ufunc generated source.
-
=likely benign Test executes generated ufunc source with annotate.Reasoning
Benign test executing ghostwriter.ufunc output with annotate=True.
-
info
critical→ info by reviewdynamic-executionhypothesis/tests/ghostwriter/test_ghostwriter_cli.py:43:12returnlikely benign Test helper wrapping subprocess.run with shell=True for CLI tests.Reasoning
A small test-utility wrapper around subprocess.run with shell=True; the cmd is supplied by test code, not untrusted input. Shell=True is a poor practice but this is a legitimate test helper, and the critical severity is overstated.
-
= = = assert ==likely benign Test evaluates repr of a strategy to verify round-trip.Reasoning
eval of repr of a Hypothesis strategy in a round-trip test checking repr stability; the input is generated locally by the test.
-
assert ==likely benign Test evals sampled strategy repr strings for round-trip checks.Reasoning
Parametrized test evaluating repr strings of strategies to check round-trip; benign test logic.
-
= = =likely benign A numpy test evaluates a parameter string to build an array before checking floor and ceil results.Reasoning
The eval call sits in a test function whose parameter is named value, and the file is a numpy test exercising floor and ceil behaviour. Test suites commonly eval a parametrized string to build an array literal. Nothing in the snippet shows attacker-controlled input, network data, or a dropper pattern. The eval is still a poor practice, and its input source is not shown, so the verdict is likely benign rather than dismissed.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&