PyPI / kombu / 5.7.0rc1

kombu 5.7.0rc1

Source

https://github.com/celery/kombu

Tag scanned

v5.7.0rc1

Compared with

v5.7.0b1 (0 signals introduced since)

Files

316 scanned, 18 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 16 info

Scan time

13.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 16 of 16 warn and critical signals; 16 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-19 03:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute kombu/__init__.py:34:1

   reach-by-name through `globals` (ast pass, confidence 0.60)

   STATICA_HACK = True
   globals()['kcah_acitats'[::-1].upper()] = False
   if STATICA_HACK:  # pragma: no cover
       # This is never executed, but tricks static analyzers (PyDev, PyCharm,

   likely benign LLM, confidence 0.90 Lazy-import/static-analyzer hack writing a globals entry via reversed string.

   Reasoning

   This is the well-known Celery/kombu lazy-import pattern: the reversed-string key 'kcah_acitats' yields 'STATICA_HACK', set to False, and the branch is never executed; it only helps static analyzers. Obfuscated-looking but benign and documented.

2. info critical → info by review dynamic-import kombu/__init__.py:78:22

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

           if name in object_origins:
               module = __import__(object_origins[name], None, None, [name])
               for extra_name in all_by_module[module.__name__]:
                   setattr(self, extra_name, getattr(module, extra_name))

   likely benign LLM, confidence 0.85 Lazy submodule import of package-internal modules via __import__ from a static mapping.

   Reasoning

   This is the standard lazy module attribute loader (__getattr__-style) in which __import__ resolves a module name from a fixed mapping object_origins built within the package. The argument is not attacker-controlled input, so it is a legitimate dynamic import.

3. info critical → info by review dynamic-import t/unit/conftest.py:86:17

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

               try:
                   __import__(module)
               except (ImportError, VersionMismatch, AttributeError):
                   pass

   likely benign LLM, confidence 0.80 Test helper probing module availability via __import__.

   Reasoning

   In a test conftest, __import__(module) is used in a try/except to probe whether optional modules are importable and skip otherwise. It is test scaffolding with no external input, so benign.

4. info critical → info by review builtins-write t/unit/conftest.py:290:5

   `builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)

   
       builtins.__import__ = myimp
       try:
           yield

   likely benign LLM, confidence 0.80 Test fixture temporarily patches builtins.__import__ to simulate import errors.

   Reasoning

   A test fixture temporarily replaces builtins.__import__ with a custom importer and restores it in finally. This is a common mocking technique for simulating import failures in tests. It is intrusive but confined to the test session and restored.

5. info critical → info by review builtins-write t/unit/conftest.py:294:9

   `builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)

       finally:
           builtins.__import__ = realimport

   likely benign LLM, confidence 0.85 Restores the original builtins.__import__ after the test patch.

   Reasoning

   This is the restore step in the finally block of the same fixture, reinstating realimport. It is the cleanup half of a benign test mock.

6. info warn → info by review decoder-decompress-payload t/unit/test_messaging.py:133:27

   file imports decoder module(s) pickle, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

           import zlib
           assert json.loads(zlib.decompress(m).decode('utf-8')) == message
   
       def test_prepare_custom_content_type(self):

   likely benign LLM, confidence 0.85 Test verifying zlib-compressed message body decodes to the expected JSON.

   Reasoning

   The zlib.decompress call in a unit test decompresses a payload the test itself just compressed to verify round-trip content-encoding behaviour. It is not a runtime dropper; the content is local test data.

7. info warn → info by review encoding-base64 t/unit/test_serialization.py:64:1

   base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

   msgpack_data = b64decode(str_to_bytes("""\
   haNpbnQKpWZsb2F0y0AJIftTyNTxpGxpc3SUpmdlb3JnZaVqZXJyeaZlbGFpbmWlY29zbW+mc3Rya\
   W5n2gArVGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIHRoZSBsYXp5IGRvZ6d1bmljb2Rl2g\
   ApVGggcXVpY2sgYnJvd24gZm94IGp1bXBzIG92ZXIgdGggbGF6eSBkb2c=\

   likely benign LLM, confidence 0.90 Base64-encoded msgpack test vector for serialization round-trip.

   Reasoning

   This is a base64-encoded msgpack fixture used in serialization tests, with readable text (e.g. 'The quick brown fox') inside. Low compression ratio is expected for short data. Test fixture, benign.

8. info warn → info by review encoding-base64 t/unit/test_serialization.py:65:1

   base64-like blob (77 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

   haNpbnQKpWZsb2F0y0AJIftTyNTxpGxpc3SUpmdlb3JnZaVqZXJyeaZlbGFpbmWlY29zbW+mc3Rya\
   W5n2gArVGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIHRoZSBsYXp5IGRvZ6d1bmljb2Rl2g\
   ApVGggcXVpY2sgYnJvd24gZm94IGp1bXBzIG92ZXIgdGggbGF6eSBkb2c=\
   """))

   likely benign LLM, confidence 0.90 Continuation of base64 msgpack test vector.

   Reasoning

   Continuation line of the same base64 msgpack test fixture; benign test data.

9. info warn → info by review encoding-base64 t/unit/test_serialization.py:66:1

   base64-like blob (58 bytes, compression ratio 1.19) (raw pass, confidence 0.60)

   W5n2gArVGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIHRoZSBsYXp5IGRvZ6d1bmljb2Rl2g\
   ApVGggcXVpY2sgYnJvd24gZm94IGp1bXBzIG92ZXIgdGggbGF6eSBkb2c=\
   """))

   likely benign LLM, confidence 0.90 Final lines of base64 msgpack test vector.

   Reasoning

   Final lines of the same base64 msgpack test fixture; benign test data.

10. info warn → info by review encoding-base64 t/unit/transport/SQS/conftest.py:101:34

    4 rows of base64-like lines, lines 101-104 (first: base64-like blob (71 bytes, compression ratio 1.15)) (raw pass, confidence 0.60)

                    'SessionToken': 'AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWs'
                                    'KWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdee'
                                    'hM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6'

    likely benign LLM, confidence 0.90 Mock AWS session token strings in SQS test fixtures.

    Reasoning

    Fake AWS SessionToken and credential-like strings in SQS test fixtures, using the AWS documentation 'EXAMPLE' style. They are mock values for tests, not real secrets or encoded payloads.

11. info warn → info by review encoding-base64 t/unit/transport/SQS/test_SQS.py:2571:30

    base64-like blob (79 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

                                'wAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wU'
                                'E8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo'

    likely benign LLM, confidence 0.90 Mock AWS session token fragment in SQS test.

    Reasoning

    Fragment of the same mock AWS session token in an SQS test file. Random-looking base64 is expected for fake credential values; benign.

12. info warn → info by review encoding-base64 t/unit/transport/SQS/test_SQS.py:2572:30

    base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

                                'E8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo'
                                '0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSI'
                                'lTJabIQwj2ICCR/oLxBA==',

    likely benign LLM, confidence 0.90 Mock AWS session token continuation in SQS test.

    Reasoning

    Continuation of the same mock AWS session token fixture in the SQS test file; benign.

13. info warn → info by review encoding-base64 t/unit/transport/SQS/test_SQS.py:2573:30

    base64-like blob (79 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

                                'E8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo'
                                '0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSI'
                                'lTJabIQwj2ICCR/oLxBA==',
            }

    likely benign LLM, confidence 0.90 Mock AWS session token final fragment in SQS test.

    Reasoning

    Final fragment of the same mock AWS session token fixture; benign test data.

14. info warn → info by review encoding-base64 t/unit/transport/test_azurestoragequeues.py:15:37

    base64-like blob (90 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

    URL_CREDS = 'azurestoragequeues://sas/key%@https://STORAGE_ACCOUNT_NAME.queue.core.windows.net/' # noqa
    AZURITE_CREDS = 'azurestoragequeues://Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==@http://localhost:10001/devstoreaccount1'  # noqa

    likely benign LLM, confidence 0.93 Azurite emulator default account key embedded in a unit test connection string.

    Reasoning

    The base64 blob is the publicly documented default account key for the Azurite storage emulator (account devstoreaccount1, localhost:10001). It is a well-known test credential, not a production secret. The file is a unit test, the value is used only against localhost or a docker-compose service, and the raw-pass base64 signal is a high-false-positive pattern. Nothing here is obfuscated.

15. info warn → info by review encoding-base64 t/unit/transport/test_azurestoragequeues.py:16:52

    base64-like blob (90 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

    AZURITE_CREDS_DOCKER_COMPOSE = 'azurestoragequeues://Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==@http://azurite:10001/devstoreaccount1'  # noqa
    DEFAULT_AZURE_URL_CREDS = 'azurestoragequeues://DefaultAzureCredential@https://STORAGE_ACCOUNT_NAME.queue.core.windows.net/' # noqa

    likely benign LLM, confidence 0.93 Same Azurite emulator default key used in a docker-compose test connection string.

    Reasoning

    This is the same public Azurite default key, used in a docker-compose connection string pointing at the 'azurite' service host. It is a documented emulator credential for test fixtures. The base64 match is a raw-pass heuristic hit on a known constant, with no decoding, execution, or concealment involved.

16. info warn → info by review encoding-base64 t/unit/transport/test_azurestoragequeues.py:55:29

    base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)

                'account_name': 'devstoreaccount1',
                'account_key': 'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw=='  # noqa
            }
            assert channel._url == f'http://{hostname}:10001/devstoreaccount1' # noqa

    likely benign LLM, confidence 0.94 Azurite emulator default account key in a test configuration dictionary.

    Reasoning

    The value is again the public Azurite default account key, set as 'account_key' in a test configuration dict alongside account_name 'devstoreaccount1' and an assertion on the localhost emulator URL. It is a well-known test fixture credential, and the code has no dynamic execution or encoded payload behaviour.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/celery/kombu kombu && cd kombu
git checkout v5.7.0rc1
disclude scan --severity info --diff v5.7.0b1 .