jsonpath-ng 1.10.0

Source: https://github.com/jsonpath-ng/jsonpath-ng
Tag scanned: v1.10.0
Compared with: v1.9.1 (4 signals introduced since)
Files: 48 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 8.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-21 14:55

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:11:1 new in this release

line length 5920 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NUMBER':([0,8,10,13,14,15,16,17,18,19,20,21,22,23,24,25,26,52,54,61,64,75,77,83,86,88,],[2,31,2,39,2,2,2,2,2,2,31,-15,-16,-17,-18,55,2,2,2,80,82,2,2,2,93,82,]),'FLOAT':([0,10,13,14,15,16,17,18,19,21,22,23,24,25,26,52,54,75,77,83,86,],[3,3,40,3,3,3,3,3,3,-15,-16,-17,-18,3,57,3,3,3,3,3,92,]),'ID':([0
```
likely benign LLM, confidence 0.95 Generated PLY LR parser action table on one long line.
Reasoning
This is a machine-generated LR parser table with a very long dictionary literal. Long lines are expected in generated data and carry no obfuscation or malicious meaning.

info long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:20:1 new in this release

line length 804 characters (raw pass, confidence 0.50)

_lr_goto_items = {'jsonpath':([0,10,13,14,15,16,17,18,19,25,26,52,54,75,77,83,],[1,37,38,41,42,43,44,45,46,56,58,76,78,85,87,76,]),'fields_or_any':([0,10,13,14,15,16,17,18,19,25,26,52,54,75,77,83,],[6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,]),'fields':([0,8,10,13,14,15,16,17,18,19,20,25,26,36,52,54,75,77,83,],[9,30,9,9,9,9,9,9,

info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/parser_table.py:11:1 new in this release

line length 2121 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NAMED_OPERATOR':([0,7,11,12,13,14,15,16,],[3,3,3,3,3,3,3,3,]),'$':([0,7,11,12,13,14,15,16,],[4,4,4,4,4,4,4,4,]),'[':([0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,26,27,28,29,30,31,32,36,38,39,41,42,43,44,45,],[5,17,-7,-8,-9,-17,5,-18,-19,-20,5,5,5,5,5,5,17,-1,-2,-3,-4,-5,-6,-10,-11,-12,-21,-16,-13,-14,-
```
likely benign LLM, confidence 0.95 Generated PLY LR parser table on one long line.
Reasoning
Generated PLY parser table data written as one long line. This is a raw-pass long-line signal with no malicious content.
info ~~critical~~ → info by review dynamic-import tests/test_ply_cache.py:61:14 new in this release

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    (name,) = parsetab_names
    module = __import__(name, fromlist=["_lr_action"])
    assert pathlib.Path(module.__file__).is_relative_to(package_directory)
```
likely benign LLM, confidence 0.80 Test dynamically importing a generated parsetab module and asserting its location.
Reasoning
A test imports a parser-table module whose name comes from a previously discovered list, then checks that its file lies within the package directory. The dynamic import is bounded to the package's own generated tables and is used for verification.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:215:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % tabfile)
            lextab = sys.modules[tabfile]
```
likely benign LLM, confidence 0.90 PLY lexer exec-based import of a generated lex table module.
Reasoning
This is the standard PLY lexer routine that imports a generated lextab module by name. The module name comes from the library's own configuration, not untrusted input, and the code matches upstream PLY.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/lex.py:450:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY helper reading the caller's frame globals to locate the lexer's namespace.
Reasoning
sys._getframe is used by PLY's get_caller_module_dict helper to read the caller's globals and locals when building a lexer. The 'anti-analysis' label comes from a co-occurrence heuristic; this is ordinary library introspection.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:1036:21

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                    pkgname = '.'.join(parts[:-1])
                    exec('import %s' % pkgname)
                    srcfile = getattr(sys.modules[pkgname], '__file__', '')
            outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.90 PLY exec-based import of the package containing the lexer source.
Reasoning
Standard PLY code that imports a package name derived from the source file's module path in order to locate the output directory. No external input reaches the import string.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1562:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                try:
                    c = eval(s)
                    if (len(c) > 1):
                        raise GrammarError('%s:%d: Literal token %s in rule %r may only be a single character' %
```
likely benign LLM, confidence 0.85 PLY eval of a grammar literal token to check it is a single character.
Reasoning
PLY evaluates a grammar-defined literal token string (for example a quoted character) to validate it is a single character. The input comes from the grammar definition written by the developer, so this is a known, benign use of eval in PLY.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1982:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % module)
            parsetab = sys.modules[module]
```
likely benign LLM, confidence 0.90 PLY exec-based import of a generated parser table module.
Reasoning
Standard PLY parser-table loading that imports a generated parsetab module by name. The module name is internal to the library.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/yacc.py:2831:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY helper reading the caller's frame globals to locate the grammar's namespace.
Reasoning
Same PLY get_caller_module_dict helper, which reads caller globals and locals to resolve the grammar namespace. Ordinary library behavior flagged by a co-occurrence heuristic.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:3201:17

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                pkgname = '.'.join(parts[:-1])
                exec('import %s' % pkgname)
                srcfile = getattr(sys.modules[pkgname], '__file__', '')
        outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.90 PLY exec-based import of the grammar's containing package.
Reasoning
Standard PLY code importing the package that contains the grammar source in order to find the output directory. The import string is derived from the module's own path.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jsonpath-ng/jsonpath-ng jsonpath-ng && cd jsonpath-ng
git checkout v1.10.0
disclude scan --severity info --diff v1.9.1 .