PyPI / joserfc / 1.7.7

joserfc 1.7.7

Source

https://github.com/authlib/joserfc

Artifact scanned

joserfc-1.7.7-py3-none-any.whl (wheel · 70.1 KB · SHA-256 06979cfbab78…)

Compared with

joserfc-1.7.6-py3-none-any.whl (0 signals introduced since)

Files

56 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

4.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 10:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review decoder-decompress-payload joserfc/_rfc7518/jwe_zips.py:23:28

   file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

           if s.startswith(self.GZIP_HEAD):
               decompressor = zlib.decompressobj()
           else:
               decompressor = zlib.decompressobj(-zlib.MAX_WBITS)

   likely benign LLM, confidence 0.90 JWE decompression of DEF/GZIP-compressed plaintext using zlib, as required by RFC 7516.

   Reasoning

   This is the standard DEFLATE/gzip decompression path for JWE 'zip' header parameter (RFC 7516), using zlib.decompressobj with raw deflate window bits for DEF and gzip header detection for GZIP. Decompressing attacker-supplied payload is the expected function of a JWE decoder; the scanner flags the generic decompress call, not an obfuscated dropper.

2. info warn → info by review encoding-base64 joserfc/jwe.py:108:9

   base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

   
           OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe
           ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb
           Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV

   likely benign LLM, confidence 0.95 Base64url-looking sample string, likely an example JWE token or key value in a library file.

   Reasoning

   Raw pass base64-like blob in a JOSE library docstring or test-vector style example; the text is a long base64url string with low compression ratio, typical of RFC example ciphertext or key material in documentation. Raw-pass findings have high false-positive rates and no code execution is involved.

3. info warn → info by review encoding-base64 joserfc/jws.py:171:9

   base64-like blob (94 bytes over 2 lines, compression ratio 1.05) (raw pass, confidence 0.60)

           .
           eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt
           cGxlLmNvbS9pc19yb290Ijp0cnVlfQ
           .

   likely benign LLM, confidence 0.95 Base64url-encoded example JWS payload (RFC 7515 sample claims) embedded in source.

   Reasoning

   The snippet decodes to a JSON object with iss/exp/http claims, i.e. the RFC 7515 example JWS payload used in documentation or a docstring. It is a plain base64url-encoded example token with no execution path, so it is a legitimate pattern.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o joserfc-1.7.7-py3-none-any.whl https://files.pythonhosted.org/packages/df/9f/934db284aa22f37af59708e382903860d4b81329c137b1b0ed2745daeb65/joserfc-1.7.7-py3-none-any.whl
printf '%s  %s\n' 06979cfbab78bc802f14c0358f32969826cc26720e13cb38926ffdc86bc0cb2c joserfc-1.7.7-py3-none-any.whl | shasum -a 256 -c -
unzip -q joserfc-1.7.7-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg