jsonpath-ng 1.11.0

Source: https://github.com/jsonpath-ng/jsonpath-ng
Tag scanned: v1.11.0
Compared with: v1.10.1 (2 signals introduced since)
Files: 64 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 6.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-21 14:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:11:1 new in this release

line length 6647 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NUMBER':([0,8,10,15,16,17,18,19,20,21,22,23,24,25,26,27,28,45,55,57,64,67,79,81,88,91,93,],[2,33,2,41,2,2,2,2,2,2,33,-15,-16,-17,-18,58,2,33,2,2,84,86,2,2,2,98,86,]),'FLOAT':([0,10,15,16,17,18,19,20,21,23,24,25,26,27,28,55,57,79,81,88,91,],[3,3,42,3,3,3,3,3,3,-15,-16,-17,-18,3,60,3,3,3,3,3,97,]),'I
```
likely benign LLM, confidence 0.90 Generated PLY parser table with long data lines.
Reasoning
This is a machine-generated PLY LR parse table with very long lines of integer/state data. Long lines in generated tables are expected and carry no executable payload.

info long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:20:1 new in this release

line length 841 characters (raw pass, confidence 0.50)

_lr_goto_items = {'jsonpath':([0,10,15,16,17,18,19,20,21,27,28,55,57,79,81,88,],[1,39,40,43,44,46,47,48,49,59,61,80,82,90,92,80,]),'fields_or_any':([0,10,15,16,17,18,19,20,21,27,28,55,57,79,81,88,],[6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,]),'fields':([0,8,10,15,16,17,18,19,20,21,22,27,28,38,45,55,57,79,81,88,],[9,32,9,9,9,9,9

info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:215:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % tabfile)
            lextab = sys.modules[tabfile]
```
likely benign LLM, confidence 0.90 PLY lexer uses exec to import its own generated lex table module.
Reasoning
This is the standard PLY lexer code that imports a generated lextab module by name. The tabfile value comes from the library's own configuration, not untrusted input, so the exec is a benign import idiom.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/lex.py:450:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY uses sys._getframe to read the caller's module namespace when building a lexer.
Reasoning
This is PLY's helper for fetching the caller's globals/locals via sys._getframe, a common pattern for building lexer/parser namespaces. The 'anti-analysis' label is an artifact of the file containing exec/eval, not evidence of evasion.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:1036:21

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                    pkgname = '.'.join(parts[:-1])
                    exec('import %s' % pkgname)
                    srcfile = getattr(sys.modules[pkgname], '__file__', '')
            outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.90 PLY imports a package by computed name to find an output directory.
Reasoning
Standard PLY code that imports the package of a source file to locate its directory for output. The module name derives from the library's own file path, so the exec is benign.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1562:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                try:
                    c = eval(s)
                    if (len(c) > 1):
                        raise GrammarError('%s:%d: Literal token %s in rule %r may only be a single character' %
```
likely benign LLM, confidence 0.90 PLY evals a grammar literal token to check it is a single character.
Reasoning
PLY evaluates a grammar literal token string (e.g. a single-character literal) with eval. The input comes from the grammar definition written by the developer, so this is a known, documented PLY pattern rather than attacker-controlled execution.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1982:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % module)
            parsetab = sys.modules[module]
```
likely benign LLM, confidence 0.90 PLY parser imports its generated parsetab module via exec.
Reasoning
Same PLY parsetab import idiom: a module name generated by the library is imported with exec and then pulled from sys.modules. No external input is involved.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/yacc.py:2831:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY uses sys._getframe to capture the caller's namespace for grammar building.
Reasoning
This is the PLY get_caller_module_dict helper using sys._getframe, shared with lex.py. It is a normal namespace-gathering technique, and the critical severity reflects the heuristic's anti-analysis shape rule rather than real evasive behaviour.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:3201:17

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                pkgname = '.'.join(parts[:-1])
                exec('import %s' % pkgname)
                srcfile = getattr(sys.modules[pkgname], '__file__', '')
        outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.90 PLY imports a package by computed name to determine the output directory.
Reasoning
Another PLY package-import-by-name for locating output directories, using a module name derived from the library's own paths. Benign.
info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/parser_table.py:11:1

line length 2121 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NAMED_OPERATOR':([0,7,11,12,13,14,15,16,],[3,3,3,3,3,3,3,3,]),'$':([0,7,11,12,13,14,15,16,],[4,4,4,4,4,4,4,4,]),'[':([0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,26,27,28,29,30,31,32,36,38,39,41,42,43,44,45,],[5,17,-7,-8,-9,-17,5,-18,-19,-20,5,5,5,5,5,5,17,-1,-2,-3,-4,-5,-6,-10,-11,-12,-21,-16,-13,-14,-
```
likely benign LLM, confidence 0.90 Generated PLY parser table with long data lines.
Reasoning
Generated PLY LR action table with long lines of state numbers. This is standard generator output and not obfuscation.
info ~~critical~~ → info by review dynamic-import tests/test_ply_cache.py:61:14

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    (name,) = parsetab_names
    module = __import__(name, fromlist=["_lr_action"])
    assert pathlib.Path(module.__file__).is_relative_to(package_directory)
```
likely benign LLM, confidence 0.85 Test dynamically imports a generated PLY parsetab module to verify its location.
Reasoning
A test imports a parsetab module by name derived from the package's own generated table names, then checks its file lies within the package directory. This is a legitimate test assertion with no external input.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jsonpath-ng/jsonpath-ng jsonpath-ng && cd jsonpath-ng
git checkout v1.11.0
disclude scan --severity info --diff v1.10.1 .