jsonpath-ng 1.10.1

Source: https://github.com/jsonpath-ng/jsonpath-ng
Tag scanned: v1.10.1
Compared with: v1.10.0 (0 signals introduced since)
Files: 49 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 8.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-21 14:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:215:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % tabfile)
            lextab = sys.modules[tabfile]
```
likely benign LLM, confidence 0.85 PLY lexer uses exec to import a configured lex table module.
Reasoning
This is PLY's standard lextab import fallback. The module name comes from the library's own configuration, not untrusted input, and the scanner flagged it only because the exec argument is non-literal.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/lex.py:450:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY helper reads the caller's module namespace via sys._getframe.
Reasoning
sys._getframe with f_globals/f_locals is PLY's standard get_caller_module_dict helper for reading the caller's namespace to build a lexer. The anti-analysis label comes only from the file also containing exec/eval, which PLY needs for its own functionality.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:1036:21

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                    pkgname = '.'.join(parts[:-1])
                    exec('import %s' % pkgname)
                    srcfile = getattr(sys.modules[pkgname], '__file__', '')
            outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.85 PLY derives a package name and exec-imports it to find the output directory.
Reasoning
This is PLY's standard code for importing a package to locate its source directory for output. The package name is derived from the library's own module path, so it is not attacker-controlled.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1562:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                try:
                    c = eval(s)
                    if (len(c) > 1):
                        raise GrammarError('%s:%d: Literal token %s in rule %r may only be a single character' %
```
likely benign LLM, confidence 0.85 PLY uses eval on a grammar literal token string to check its length.
Reasoning
PLY evaluates a grammar literal token such as a quoted single character with eval to validate its length. The input is grammar source written by the developer, not runtime or network data.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1982:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % module)
            parsetab = sys.modules[module]
```
likely benign LLM, confidence 0.85 PLY yacc uses exec to import a configured parsetab module.
Reasoning
This is PLY's standard parsetab import fallback. The module name is configured by the library, so the exec is not an injection vector in this context.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/yacc.py:2831:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY helper reads the caller's module namespace via sys._getframe.
Reasoning
This is the same standard PLY get_caller_module_dict helper using sys._getframe. The anti-analysis shape is inferred from exec/eval elsewhere in the file, which is normal for PLY.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:3201:17

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                pkgname = '.'.join(parts[:-1])
                exec('import %s' % pkgname)
                srcfile = getattr(sys.modules[pkgname], '__file__', '')
        outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.85 PLY derives a package name and exec-imports it to locate source files.
Reasoning
This matches the standard PLY pattern of importing a package by name to find its source directory. The name comes from the library's module path.
info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:11:1

line length 5920 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NUMBER':([0,8,10,13,14,15,16,17,18,19,20,21,22,23,24,25,26,52,54,61,64,75,77,83,86,88,],[2,31,2,39,2,2,2,2,2,2,31,-15,-16,-17,-18,55,2,2,2,80,82,2,2,2,93,82,]),'FLOAT':([0,10,13,14,15,16,17,18,19,21,22,23,24,25,26,52,54,75,77,83,86,],[3,3,40,3,3,3,3,3,3,-15,-16,-17,-18,3,57,3,3,3,3,3,92,]),'ID':([0
```
likely benign LLM, confidence 0.95 Generated PLY parser table with a very long line of action data.
Reasoning
This is a generated LR parser table with a very long dictionary literal. Long generated tables are expected and contain no executable payload.

info long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:20:1

line length 804 characters (raw pass, confidence 0.50)

_lr_goto_items = {'jsonpath':([0,10,13,14,15,16,17,18,19,25,26,52,54,75,77,83,],[1,37,38,41,42,43,44,45,46,56,58,76,78,85,87,76,]),'fields_or_any':([0,10,13,14,15,16,17,18,19,25,26,52,54,75,77,83,],[6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,]),'fields':([0,8,10,13,14,15,16,17,18,19,20,25,26,36,52,54,75,77,83,],[9,30,9,9,9,9,9,9,

info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/parser_table.py:11:1

line length 2121 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NAMED_OPERATOR':([0,7,11,12,13,14,15,16,],[3,3,3,3,3,3,3,3,]),'$':([0,7,11,12,13,14,15,16,],[4,4,4,4,4,4,4,4,]),'[':([0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,26,27,28,29,30,31,32,36,38,39,41,42,43,44,45,],[5,17,-7,-8,-9,-17,5,-18,-19,-20,5,5,5,5,5,5,17,-1,-2,-3,-4,-5,-6,-10,-11,-12,-21,-16,-13,-14,-
```
likely benign LLM, confidence 0.95 Generated PLY parser table with a long line of action data.
Reasoning
This is a generated LR parser table. The long line is ordinary machine-generated data, and the raw-pass long-line signal is a known false-positive shape.
info ~~critical~~ → info by review dynamic-import tests/test_ply_cache.py:61:14

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    (name,) = parsetab_names
    module = __import__(name, fromlist=["_lr_action"])
    assert pathlib.Path(module.__file__).is_relative_to(package_directory)
```
likely benign LLM, confidence 0.80 Test dynamically imports a generated PLY parsetab module and checks its path.
Reasoning
The test imports a module whose name was read from the generated parsetab names and then checks that its file lies inside the package directory. This is a sanity check on the test's own cache, not an injection path, though the dynamic import is a minor concern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jsonpath-ng/jsonpath-ng jsonpath-ng && cd jsonpath-ng
git checkout v1.10.1
disclude scan --severity info --diff v1.10.0 .