jsonpath-ng 1.12.0

Source: https://github.com/jsonpath-ng/jsonpath-ng
Tag scanned: v1.12.0
Compared with: v1.11.0 (2 signals introduced since)
Files: 66 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 10.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 08:24

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:11:1 new in this release

line length 7047 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NUMBER':([0,8,10,15,16,17,18,19,20,21,22,23,24,25,26,27,28,42,55,57,64,67,79,81,88,91,93,106,],[2,33,2,2,2,2,2,2,2,48,33,-15,-16,-17,-18,58,2,33,2,2,84,86,2,2,2,98,86,112,]),'FLOAT':([0,10,15,16,17,18,19,20,21,23,24,25,26,27,28,55,57,79,81,88,91,],[3,3,3,3,3,3,3,3,49,-15,-16,-17,-18,3,60,3,3,3,3,3,
```
likely benign LLM, confidence 0.95 Generated PLY parser table with a very long data line.
Reasoning
This is a generated LR parse table, and its length follows from the grammar size. The data is numeric state tables and token names, with no executable or encoded payload. Long lines are normal for generated tables.

info long-line src/jsonpath_ng/_ply_tables/ext_parser_table.py:20:1 new in this release

line length 905 characters (raw pass, confidence 0.50)

_lr_goto_items = {'jsonpath':([0,10,15,16,17,18,19,20,21,27,28,55,57,79,81,88,],[1,39,40,41,43,44,45,46,47,59,61,80,82,90,92,80,]),'fields_or_any':([0,10,15,16,17,18,19,20,21,27,28,55,57,79,81,88,],[5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,]),'fields':([0,8,10,15,16,17,18,19,20,21,22,27,28,38,42,55,57,79,81,88,],[9,32,9,9,9,9,9

info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:215:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % tabfile)
            lextab = sys.modules[tabfile]
```
likely benign LLM, confidence 0.92 PLY lexer code that imports a cached lex table module by name via exec.
Reasoning
This is PLY's standard lextab loader. It runs exec('import %s' % tabfile) on a module name that the library itself generates from its own configuration, and it is a long-established pattern in PLY. Nothing here is attacker-controlled or obfuscated.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/lex.py:450:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.92 PLY helper that inspects the caller's frame to find the module namespace.
Reasoning
sys._getframe is used by PLY's get_caller_module_dict to read the caller's globals and locals so that lexer and parser specs can be resolved. The co-occurrence with exec/eval is the normal shape of a parser generator, not an anti-analysis technique.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/lex.py:1036:21

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                    pkgname = '.'.join(parts[:-1])
                    exec('import %s' % pkgname)
                    srcfile = getattr(sys.modules[pkgname], '__file__', '')
            outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.92 PLY code that imports a package by derived name to find its source file path.
Reasoning
This is the same PLY pattern: exec('import %s' % pkgname) where pkgname is derived from the module path of the grammar file being processed to locate the output directory. It is a library-internal import, not a payload.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1562:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                try:
                    c = eval(s)
                    if (len(c) > 1):
                        raise GrammarError('%s:%d: Literal token %s in rule %r may only be a single character' %
```
likely benign LLM, confidence 0.90 PLY grammar validation that evals a literal token string to check its length.
Reasoning
eval(s) evaluates a literal token string from the user's grammar specification, such as a quoted single character, to check that it is one character long. This is the expected way PLY handles literal tokens. The input is grammar source, not untrusted network data.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:1982:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            exec('import %s' % module)
            parsetab = sys.modules[module]
```
likely benign LLM, confidence 0.92 PLY code that imports the cached parse table module by name.
Reasoning
This is the same PLY parsetab loader: exec('import %s' % module) on a library-generated module name, followed by a lookup in sys.modules. It is standard and benign.
info ~~critical~~ → info by review frame-introspection src/jsonpath_ng/_ply/yacc.py:2831:9

`sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
def get_caller_module_dict(levels):
    f = sys._getframe(levels)
    ldict = f.f_globals.copy()
    if f.f_globals != f.f_locals:
```
likely benign LLM, confidence 0.92 PLY helper that reads the caller's frame globals and locals.
Reasoning
This is the PLY get_caller_module_dict helper, which uses sys._getframe to read the caller's namespace. It is a standard parser-generator mechanism and not an anti-analysis measure.
info ~~warn~~ → info by review dynamic-execution src/jsonpath_ng/_ply/yacc.py:3201:17

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                pkgname = '.'.join(parts[:-1])
                exec('import %s' % pkgname)
                srcfile = getattr(sys.modules[pkgname], '__file__', '')
        outputdir = os.path.dirname(srcfile)
```
likely benign LLM, confidence 0.92 PLY code that imports a package by derived name to resolve its file path.
Reasoning
This is the same PLY code that derives a package name and imports it with exec to locate the source directory for output. It is library-internal and benign.
info ~~warn~~ → info by review long-line src/jsonpath_ng/_ply_tables/parser_table.py:11:1

line length 2121 characters (raw pass, confidence 0.65)
```
_lr_action_items = {'NAMED_OPERATOR':([0,7,11,12,13,14,15,16,],[3,3,3,3,3,3,3,3,]),'$':([0,7,11,12,13,14,15,16,],[4,4,4,4,4,4,4,4,]),'[':([0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,26,27,28,29,30,31,32,36,38,39,41,42,43,44,45,],[5,17,-7,-8,-9,-17,5,-18,-19,-20,5,5,5,5,5,5,17,-1,-2,-3,-4,-5,-6,-10,-11,-12,-21,-16,-13,-14,-
```
likely benign LLM, confidence 0.95 Generated PLY parser table with a long data line.
Reasoning
This is a generated PLY LR action table of token-to-state integer lists. The long line is typical of generated output and contains no executable or obfuscated content.
info ~~critical~~ → info by review dynamic-import tests/test_ply_cache.py:61:14

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    (name,) = parsetab_names
    module = __import__(name, fromlist=["_lr_action"])
    assert pathlib.Path(module.__file__).is_relative_to(package_directory)
```
likely benign LLM, confidence 0.80 Test that dynamically imports a cached PLY parse table and checks that its path is inside the package.
Reasoning
The test imports a module whose name comes from parsetab_names, which the test derives from the cache directory. It then asserts that the imported module's file lies inside the package directory, which is a guard against loading code from outside the package. This is consistent with a test for the cache, though the dynamic name is not a literal.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/jsonpath-ng/jsonpath-ng jsonpath-ng && cd jsonpath-ng
git checkout v1.12.0
disclude scan --severity info --diff v1.11.0 .