msal 1.39.0

Source: https://github.com/AzureAD/microsoft-authentication-library-for-python
Tag scanned: 1.39.0
Compared with: 1.38.0 (0 signals introduced since)
Files: 84 scanned, 14 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 16 info
Scan time: 8.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:49

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line README.md:5:1

line length 662 characters (raw pass, confidence 0.50)

 [![Build status](https://github.com/AzureAD/microsoft-authentication-library-for-python/actions/workflows/python-package.yml/badge.svg?branch=dev)](https://github.com/AzureAD/microsoft-authentication-library-for-python/actions) | [![Documentation Status](https://readthedocs.org/projects/msal-python/badge/?version=late

info ~~warn~~ → info by review encoding-base64 msal/__main__.py:166:31

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
_JWK1 = """{"kty":"RSA", "n":"2tNr73xwcj6lH7bqRZrFzgSLj7OeLfbn8216uOMDHuaZ6TEUBDN8Uz0ve8jAlKsP9CQFCSVoSNovdE-fs7c15MxEGHjDcNKLWonznximj8pDGZQjVdfK-7mG6P6z-lgVcLuYu5JcWU_PeEqIKg5llOaz-qeQ4LEDS4T1D2qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3F
```
dismissed LLM, confidence 0.90 A public RSA JWK string literal in the MSAL package's __main__ module.
Reasoning
Raw-pass base64 heuristic matched an RSA public JWK literal (kty/n/e fields) used as a test vector in the MSAL package's own main module. Public key material with no secret, and the high-entropy match is a known raw-pass false-positive pattern. Not obfuscation.
info ~~warn~~ → info by review encoding-base64 msal/__main__.py:166:247

base64-like blob (104 bytes, compression ratio 1.04) (raw pass, confidence 0.60)
```
qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3Fe11Xz8AEBl3anKFSJcTvlMnFtu3EpD-eiaHfTgRBU7CztGQqVbiQ", "e":"AQAB"}"""
```
dismissed LLM, confidence 0.90 Tail of the same public RSA JWK literal in msal/__main__.py.
Reasoning
Continuation of the same RSA public JWK literal (modulus tail and exponent AQAB). Public key data embedded as a constant, with no decoding, execution or network use.

info encoding-base64 msal/__main__.py:195:176

base64-like blob (68 bytes, compression ratio 0.90) (in comment) (raw pass, confidence 0.36)

    POP_SCOPE = ['6256c85f-0aad-4d50-b960-e6e9b21efe35/.default']  # KAP 1P Server App Scope, obtained from https://github.com/Azure/azure-cli-extensions/pull/4468/files#diff-a47efa3186c7eb4f1176e07d0b858ead0bf4a58bfd51e448ee3607a5b4ef47f6R116
    result = _acquire_token_interactive(app, scopes=POP_SCOPE)

info whitespace-anomaly msal/broker.py:14:1

file mixes tab and space indentation (1 tab-indented and 226 space-indented lines) (raw pass, confidence 0.40)

try:
    import pymsalruntime  # Its API description is available in site-packages/pymsalruntime/PyMsalRuntime.pyi
    pymsalruntime.register_logging_callback(lambda message, level: {  # New in pymsalruntime 0.7
        pymsalruntime.LogLevel.TRACE: logger.debug,  # Python has no TRACE level

info encoding-base64 msal/throttled_http_client.py:16:98

base64-like blob (67 bytes, compression ratio 0.87) (in comment) (raw pass, confidence 0.36)

    # MSAL's HttpResponse did not have headers until 1.23.0
    # https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/581/files#diff-28866b706bc3830cd20485685f20fe79d45b58dce7050e68032e9d9372d68654R61
    # This helper ensures graceful degradation to {} without exception

info whitespace-anomaly msal/token_cache.py:46:1

file mixes tab and space indentation (1 tab-indented and 524 space-indented lines) (raw pass, confidence 0.40)

_EXT_CACHE_KEY_EXCLUDED_FIELDS = frozenset({
    # Standard OAuth2 body parameters — these appear in every token request
    # and must NOT influence the extended cache key.
    # Only non-standard fields (e.g. fmi_path) should contribute to the hash.

info ~~warn~~ → info by review encoding-base64 tests/broker-test.py:34:31

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
_JWK1 = """{"kty":"RSA", "n":"2tNr73xwcj6lH7bqRZrFzgSLj7OeLfbn8216uOMDHuaZ6TEUBDN8Uz0ve8jAlKsP9CQFCSVoSNovdE-fs7c15MxEGHjDcNKLWonznximj8pDGZQjVdfK-7mG6P6z-lgVcLuYu5JcWU_PeEqIKg5llOaz-qeQ4LEDS4T1D2qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3F
```
dismissed LLM, confidence 0.92 A public RSA JWK test fixture in a broker test script.
Reasoning
Same public RSA JWK test vector as in the library, in a test file. Base64url-encoded key parameters are expected in auth test fixtures.
info ~~warn~~ → info by review encoding-base64 tests/broker-test.py:34:247

base64-like blob (104 bytes, compression ratio 1.04) (raw pass, confidence 0.60)
```
qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3Fe11Xz8AEBl3anKFSJcTvlMnFtu3EpD-eiaHfTgRBU7CztGQqVbiQ", "e":"AQAB"}"""
```
dismissed LLM, confidence 0.92 Tail of the public JWK test fixture in tests/broker-test.py.
Reasoning
Tail of the same JWK test fixture, ending in the AQAB exponent. Ordinary test data with no execution path.
info ~~warn~~ → info by review encoding-base64 tests/test_ccs.py:26:22

base64-like blob (123 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
                "client_info":  # MSAL asks for client_info, so it would be available
                    "eyJ1aWQiOiJhYTkwNTk0OS1hMmI4LTRlMGEtOGFlYS1iMzJlNTNjY2RiNDEiLCJ1dGlkIjoiNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjQ3In0",
                })
            self.assertEqual(
```
dismissed LLM, confidence 0.93 A base64url client_info test value passed to a mocked response.
Reasoning
The blob decodes to a JSON-like structure of uid and utid fields, a standard MSAL client_info value supplied as a mock. It is a fixture for a test that expects that header, not a payload.
info ~~warn~~ → info by review encoding-base64 tests/test_e2e.py:802:35

base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
    _JWK1 = """{"kty":"RSA", "n":"2tNr73xwcj6lH7bqRZrFzgSLj7OeLfbn8216uOMDHuaZ6TEUBDN8Uz0ve8jAlKsP9CQFCSVoSNovdE-fs7c15MxEGHjDcNKLWonznximj8pDGZQjVdfK-7mG6P6z-lgVcLuYu5JcWU_PeEqIKg5llOaz-qeQ4LEDS4T1D2qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66l
```
dismissed LLM, confidence 0.92 A public RSA JWK fixture in the e2e test module.
Reasoning
Same public RSA JWK test vector as the other copies, in an end-to-end test. Public key fixture data.
info ~~warn~~ → info by review encoding-base64 tests/test_e2e.py:802:251

base64-like blob (104 bytes, compression ratio 1.04) (raw pass, confidence 0.60)
```
qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3Fe11Xz8AEBl3anKFSJcTvlMnFtu3EpD-eiaHfTgRBU7CztGQqVbiQ", "e":"AQAB"}"""
```
dismissed LLM, confidence 0.92 Tail of the public JWK fixture in tests/test_e2e.py.
Reasoning
Tail of the same JWK fixture in the e2e tests. Ordinary test data.

info encoding-base64 tests/test_e2e.py:833:82

base64-like blob (68 bytes, compression ratio 0.90) (in comment) (raw pass, confidence 0.36)

        '6256c85f-0aad-4d50-b960-e6e9b21efe35/.default',  # Azure CLI's connectedk8s plugin uses this
            # https://github.com/Azure/azure-cli-extensions/pull/4468/files#diff-a47efa3186c7eb4f1176e07d0b858ead0bf4a58bfd51e448ee3607a5b4ef47f6R116
    ]

info ~~warn~~ → info by review encoding-base64 tests/test_oidc.py:81:62

base64-like blob (104 bytes, compression ratio 0.97) (raw pass, confidence 0.60)
```
class TestIdToken(unittest.TestCase):
    EXPIRED_ID_TOKEN = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJpc3N1ZXIiLCJpYXQiOjE3MDY1NzA3MzIsImV4cCI6MTY3NDk0ODMzMiwiYXVkIjoiZm9vIiwic3ViIjoic3ViamVjdCJ9.wyWNFxnE35SMP6FpxnWZmWQAy4KD0No_Q1rUy5bNnLs"

    _EXPECTED_CLAIMS = {
```
dismissed LLM, confidence 0.93 An expired JWT ID token string used as a unit-test fixture.
Reasoning
A JWT with a readable JSON header (typ JWT, alg HS256) and claims for issuer, audience and expiry, used as an expired ID token fixture for unit tests. Test data, not obfuscation.
info ~~warn~~ → info by review encoding-base64 tests/test_optional_thumbprint.py:15:1

base64-like blob (128 bytes over 2 lines, compression ratio 1.02) (raw pass, confidence 0.60)
```
    test_private_key = """-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKj
MzEfYyjiWA4R4/M2bS1+fWIcPm15j7uo6xKvRr4PNx5bKMDFqMdW6/xfqFWX0nZK
-----END PRIVATE KEY-----"""
```
likely benign LLM, confidence 0.90 A PEM private key string literal in a thumbprint test.
Reasoning
A PEM-formatted private key block inside a test module, used to exercise optional thumbprint handling. Typically a throwaway test key, and the raw base64 match on PEM body lines is expected. Worth noting that a real private key in a repo would matter, but the test context and the PEM framing point to a fixture.
info ~~warn~~ → info by review encoding-base64 tests/test_optional_thumbprint.py:20:1

base64-like blob (128 bytes over 2 lines, compression ratio 0.88) (raw pass, confidence 0.60)
```
    test_certificate = """-----BEGIN CERTIFICATE-----
MIIC5jCCAc6gAwIBAgIJALdYQVsVsNZHMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNV
BAMMC0V4YW1wbGUgQ0EwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjAW
-----END CERTIFICATE-----"""
```
dismissed LLM, confidence 0.90 A PEM certificate string literal in a thumbprint test.
Reasoning
A PEM certificate with a subject of Example CA in a test module, consistent with a generated test certificate. Certificates are public, and the raw match on the body is expected.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/AzureAD/microsoft-authentication-library-for-python microsoft-authentication-library-for-python && cd microsoft-authentication-library-for-python
git checkout 1.39.0
disclude scan --severity info --diff 1.38.0 .