jsonpath-ng 1.12.0

Source: https://github.com/jsonpath-ng/jsonpath-ng
Tag scanned: v1.12.0
Compared with: v1.11.0 (2 signals introduced since)
Files: 66 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 7.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-21 14:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:11:1 new in this release

line length 7047 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NUMBER':([0,8,10,15,16,17,18,19,20,21,22,23,24,25,26,27,28,42,55,57,64,67,79,81,88,91,93,106,],[2,33,2,2,2,2,2,2,2,48,33,-15,-16,-17,-18,58,2,33,2,2,84,86,2,2,2,98,86,112,]),'FLOAT':([0,10,15,16,17,18,19,20,21,23,24,25,26,27,28,55,57,79,81,88,91,],[3,3,3,3,3,3,3,3,49,-15,-16,-17,-18,3,60,3,3,3,3,3,
```
likely benign LLM, confidence 0.85 Generated PLY parser table with very long data lines.
Reasoning
This is a generated PLY LR parse table; long lines of integer state tables are expected for machine-generated parser tables. Raw-pass long-line signal has high false-positive rate and no executable payload is shown.

info long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:20:1 new in this release

line length 905 characters (raw pass, confidence 0.50)

_lr_goto_items = {'jsonpath':([0,10,15,16,17,18,19,20,21,27,28,55,57,79,81,88,],[1,39,40,41,43,44,45,46,47,59,61,80,82,90,92,80,]),'fields_or_any':([0,10,15,16,17,18,19,20,21,27,28,55,57,79,81,88,],[5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,]),'fields':([0,8,10,15,16,17,18,19,20,21,22,27,28,38,42,55,57,79,81,88,],[9,32,9,9,9,9,9

info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:215:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % tabfile)
            lextab = sys.modules[tabfile]
```
likely benign LLM, confidence 0.90 PLY lexer dynamically imports its generated table module via exec.
Reasoning
This is PLY's standard lexer table loading: exec('import %s' % tabfile) imports a parser/lexer table module whose name comes from the library's own configuration, not untrusted input. Legitimate, if dated, pattern.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/lex.py:450:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY helper reads caller frame globals to collect lexer rule definitions.
Reasoning
get_caller_module_dict uses sys._getframe to read caller globals/locals, which is the upstream PLY idiom for resolving token/rule definitions from the calling module. The anti-analysis label is a false association with the file containing exec/eval for legitimate reasons.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:1036:21

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                    pkgname = '.'.join(parts[:-1])
                    exec('import %s' % pkgname)
                    srcfile = getattr(sys.modules[pkgname], '__file__', '')
            outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.90 PLY imports a package by name to locate its source directory for output.
Reasoning
Same PLY pattern: exec('import %s' % pkgname) to locate the package of the source file for output directory determination, with pkgname derived from the caller's module name. No external input.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1562:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                try:
                    c = eval(s)
                    if (len(c) > 1):
                        raise GrammarError('%s:%d: Literal token %s in rule %r may only be a single character' %
```
likely benign LLM, confidence 0.90 PLY evaluates a grammar literal token to validate its length.
Reasoning
eval(s) in PLY's yacc grammar validation evaluates a literal token string from the grammar spec (e.g. a quoted character) to check it is a single character. This is upstream PLY behavior and the input is developer-authored grammar text.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1982:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % module)
            parsetab = sys.modules[module]
```
likely benign LLM, confidence 0.90 PLY yacc dynamically imports its parsetab module via exec.
Reasoning
PLY's parser table loader uses exec to import a generated parsetab module by name. Standard library behavior with a configuration-derived module name.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/yacc.py:2831:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.90 PLY yacc helper inspects caller frame to gather grammar definitions.
Reasoning
Upstream PLY get_caller_module_dict reading caller frame globals to resolve grammar definitions. The critical severity comes from a heuristic co-occurrence with exec/eval, not from malicious behavior.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:3201:17

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                pkgname = '.'.join(parts[:-1])
                exec('import %s' % pkgname)
                srcfile = getattr(sys.modules[pkgname], '__file__', '')
        outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.90 PLY imports a package by name to locate its source directory.
Reasoning
PLY's output-directory logic imports the package named from the caller's module via exec. Same benign upstream pattern as the other exec calls in this vendored library.
info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/parser_table.py:11:1

line length 2121 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NAMED_OPERATOR':([0,7,11,12,13,14,15,16,],[3,3,3,3,3,3,3,3,]),'$':([0,7,11,12,13,14,15,16,],[4,4,4,4,4,4,4,4,]),'[':([0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,26,27,28,29,30,31,32,36,38,39,41,42,43,44,45,],[5,17,-7,-8,-9,-17,5,-18,-19,-20,5,5,5,5,5,5,17,-1,-2,-3,-4,-5,-6,-10,-11,-12,-21,-16,-13,-14,-
```
likely benign LLM, confidence 0.85 Generated PLY parser table with long data lines.
Reasoning
Generated PLY parser action table consisting of integer state lists; the long line is data formatting from the generator, not obfuscated code.
info ~~critical~~ → info by review dynamic-import tests/test_ply_cache.py:61:14

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    (name,) = parsetab_names
    module = __import__(name, fromlist=["_lr_action"])
    assert pathlib.Path(module.__file__).is_relative_to(package_directory)
```
likely benign LLM, confidence 0.80 Test dynamically imports a generated parsetab module found in the package directory.
Reasoning
The test imports a module whose name comes from parsetab_names discovered in the package directory, then asserts its file is inside the package directory. This is a test verifying cache locations; the non-literal import is confined to the project's own files.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jsonpath-ng/jsonpath-ng jsonpath-ng && cd jsonpath-ng
git checkout v1.12.0
disclude scan --severity info --diff v1.11.0 .