disclude.ioPyPI / hypothesis / 6.170.7
hypothesis 6.170.7
- Source
- https://github.com/HypothesisWorks/hypothesis
- Artifact scanned
hypothesis-6.170.7.tar.gz- Compared with
hypothesis-6.170.5.tar.gz(1 signals introduced since)- Files
- 114 scanned, 6 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 34 info
- Scan time
- 14.2 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 15 of 15 warn and critical signals; 15 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 14:13
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
info
warn→ info by reviewdynamic-executionsrc/hypothesis/extra/ghostwriter.py:1841:13new in this release# executed; so you still shouldn't ghostwrite for hostile code. =likely benign Validates that an identity repr compiles, falling back to repr() on SyntaxError.Reasoning
compile(..., 'exec') is wrapped in a SyntaxError handler and the comment notes that ghostwriting for hostile code is not supported. It only validates a repr string and falls back to repr() on failure, with no execution of the result.
-
) = =likely benign Captures the caller's frame to report where reject() was invoked.Reasoning
inspect.currentframe() is used to find the calling location for reject() so Hypothesis can report where the rejection happened. This is ordinary introspection for diagnostics, with no network, decoding, or process activity.
-
= =likely benign Captures the caller's frame to record the location of an assume() call.Reasoning
Same pattern as the reject() site: the frame is used only to record the source location of an assume() call for observability output. Nothing here is executed from data.
-
=likely benign Base64-decodes and zlib-decompresses a versioned blob, raising InvalidArgument on corrupt data.Reasoning
This decodes a prefixed, base64-encoded value and inflates it with zlib, then raises InvalidArgument on zlib.error. It looks like Hypothesis's own serialization format for stored examples or a seed/blob, not a hidden payload. Decompressing data is not executing it, and the error handling is consistent with parsing user-supplied input.
-
likely benign Checks whether a strategy repr is valid Python syntax before using it in generated code.
Reasoning
compile() is applied to repr() of a Hypothesis strategy inside a contextlib.suppress(SyntaxError) block, purely to check whether the repr is valid Python before using it as a fallback. The compiled code is never run, and the input is generated internally from the library's own strategies.
-
= # Finally, try to work out the imports we need for builds(), .map(), # .filter(), and .flatmap() to work without NameErrorlikely benign Syntax-checks a generated expression string used in ghostwritten tests.Reasoning
The compile() call checks syntax of a regex-cleaned expression string that is being assembled for ghostwritten test code. It is a syntax validation step; the result is not executed.
-
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# The sum of a geometric series is given by (ref: wikipedia): # ᵐ∑ₖ₌₀ aᵏ = (aᵐ⁺¹ - 1) / (a - 1) # = S(m) / S(0) # assuming a != 1 and using the definition -
# assuming a != 1 and using the definition # S(m) := aᵐ⁺¹ - 1. # The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
# The sum we want, starting from a number n [0 <= n <= m] rather than zero, is # ᵐ∑ₖ₌ₙ aᵏ = ᵐ∑ₖ₌₀ aᵏ - ⁿ⁻¹∑ₖ₌₀ aᵏ = S(m) / S(0) - S(n - 1) / S(0) return ** - 1 -
info
warn→ info by reviewframe-introspectionsrc/hypothesis/internal/conjecture/junkdrawer.py:316:13""" frame = sys._getframe(2) size = 1 while frame:likely benign Walks the call stack to measure its depth for an internal size estimate.Reasoning
sys._getframe(2) is used to walk the stack and measure its size, likely for a recursion or stack-depth heuristic inside the engine. This is internal bookkeeping with no effect outside the process.
-
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# common unicode characters , # characters which increase in length when lowercased -
# ligatures , # emoticons , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
# upsidown text , # reserved strings in windows , -
�̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
�͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ⟨U+034F⟩͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ -
# stack frames up. = = = flikely benign Reads the caller's filename and line number to label a coverage entry.Reasoning
The caller frame is used to build a human-readable description (file name and line number) for coverage or observability labels. This is a standard introspection pattern for naming, not evasion.
-
=likely benign Evaluates reconstructed lambda source in the function's globals to rebuild the callable.Reasoning
eval() evaluates a source string reconstructed from a lambda's code object in its original globals. This is how Hypothesis recovers lambda source for repr and reproduction. The source comes from the program's own code objects, not from external input, and the surrounding code is a documented reconstruction path.
-
) =likely benign Executes a generated constructor snippet to rebuild a lambda that has closure variables.Reasoning
exec() runs a generated helper that rebuilds a lambda with its free variables, as part of the same source-reconstruction mechanism. The string is built from the local code object's structure, not from untrusted input, so this is a known and intentional pattern.
-
assert = returnlikely benign Executes reconstructed function source into a fresh namespace and caches the result.Reasoning
exec(source, result.__dict__) runs source text that was produced by Hypothesis's own lambda and function source extraction and caches the result. This is the core dynamic-reconstruction step used when rebuilding functions, not an obfuscated dropper.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Installs a trace function for line-level coverage while a scrutinized block runs.Reasoning
sys.settrace(self.trace) is installed inside a context manager guarded for Python below 3.12. It is a coverage/scrutiny tool that records lines executed during a test, a well-known and documented technique, and it is removed on exit.
-
# pragma: no cover # only on Python < 3.12 returnlikely benign Removes the trace function on exit from the scrutinized block.Reasoning
sys.settrace(None) is the matching teardown for the trace installed on entry. Clearing the trace function is expected cleanup and carries no malicious signal.
-
info
warn→ info by reviewframe-introspectionsrc/hypothesis/strategies/_internal/strategies.py:103:31return : | None = =likely benign Walks up the stack past Hypothesis's own files to find the user's calling location.Reasoning
sys._getframe(1) walks up past Hypothesis's own files to find the user's calling location, which is used to report where a strategy was defined. This is ordinary frame introspection for error reporting.
-
: | None = None : | None = = flikely benign Hypothesis's type-strategy code walks the call stack via sys._getframe to record source locations for reporting.Reasoning
sys._getframe() is used here to walk the call stack to locate the user's source file and line where a strategy was defined, which is a common legitimate pattern in a property-based testing library for error reporting. No network, process spawning, decoding or dynamic execution is present in the snippet.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&