disclude.io

PyPI / msal / 1.39.0

msal 1.39.0

Source
https://github.com/AzureAD/microsoft-authentication-library-for-python
Tag scanned
1.39.0
Compared with
1.38.0 (0 signals introduced since)
Files
84 scanned, 14 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 16 info
Scan time
8.2 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-22 05:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info long-line README.md:5:1

    line length 662 characters (raw pass, confidence 0.50)

     [![Build status](https://github.com/AzureAD/microsoft-authentication-library-for-python/actions/workflows/python-package.yml/badge.svg?branch=dev)](https://github.com/AzureAD/microsoft-authentication-library-for-python/actions) | [![Documentation Status](https://readthedocs.org/projects/msal-python/badge/?version=late
  2. info warn → info by review encoding-base64 msal/__main__.py:166:31

    base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

    _JWK1 = """{"kty":"RSA", "n":"2tNr73xwcj6lH7bqRZrFzgSLj7OeLfbn8216uOMDHuaZ6TEUBDN8Uz0ve8jAlKsP9CQFCSVoSNovdE-fs7c15MxEGHjDcNKLWonznximj8pDGZQjVdfK-7mG6P6z-lgVcLuYu5JcWU_PeEqIKg5llOaz-qeQ4LEDS4T1D2qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3F
    dismissed LLM, confidence 0.93 A hardcoded RSA JWK string constant in the MSAL library's __main__ module.
    Reasoning

    The snippet is a JSON Web Key (kty/n/e fields) for RSA, written as a string constant in the MSAL library's own CLI module. The base64url fields are public key material and the pattern is ordinary for JWK handling. Nothing decodes or executes the blob.

  3. info warn → info by review encoding-base64 msal/__main__.py:166:247

    base64-like blob (104 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

    qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3Fe11Xz8AEBl3anKFSJcTvlMnFtu3EpD-eiaHfTgRBU7CztGQqVbiQ", "e":"AQAB"}"""
    dismissed LLM, confidence 0.93 The tail of the same hardcoded RSA JWK constant, ending in the public exponent.
    Reasoning

    This is the continuation of the same JWK constant (the n value's tail and the e=AQAB exponent). It is a normal base64url key encoding with no execution or decoding path.

  4. info encoding-base64 msal/__main__.py:195:176

    base64-like blob (68 bytes, compression ratio 0.90) (in comment) (raw pass, confidence 0.36)

        POP_SCOPE = ['6256c85f-0aad-4d50-b960-e6e9b21efe35/.default']  # KAP 1P Server App Scope, obtained from https://github.com/Azure/azure-cli-extensions/pull/4468/files#diff-a47efa3186c7eb4f1176e07d0b858ead0bf4a58bfd51e448ee3607a5b4ef47f6R116
    result = _acquire_token_interactive(app, scopes=POP_SCOPE)
  5. info whitespace-anomaly msal/broker.py:14:1

    file mixes tab and space indentation (1 tab-indented and 226 space-indented lines) (raw pass, confidence 0.40)

    try:
    import pymsalruntime  # Its API description is available in site-packages/pymsalruntime/PyMsalRuntime.pyi
    pymsalruntime.register_logging_callback(lambda message, level: {  # New in pymsalruntime 0.7
        pymsalruntime.LogLevel.TRACE: logger.debug,  # Python has no TRACE level
  6. info encoding-base64 msal/throttled_http_client.py:16:98

    base64-like blob (67 bytes, compression ratio 0.87) (in comment) (raw pass, confidence 0.36)

        # MSAL's HttpResponse did not have headers until 1.23.0
    # https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/581/files#diff-28866b706bc3830cd20485685f20fe79d45b58dce7050e68032e9d9372d68654R61
    # This helper ensures graceful degradation to {} without exception
  7. info whitespace-anomaly msal/token_cache.py:46:1

    file mixes tab and space indentation (1 tab-indented and 524 space-indented lines) (raw pass, confidence 0.40)

    _EXT_CACHE_KEY_EXCLUDED_FIELDS = frozenset({
    # Standard OAuth2 body parameters — these appear in every token request
    # and must NOT influence the extended cache key.
    # Only non-standard fields (e.g. fmi_path) should contribute to the hash.
  8. info warn → info by review encoding-base64 tests/broker-test.py:34:31

    base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

    _JWK1 = """{"kty":"RSA", "n":"2tNr73xwcj6lH7bqRZrFzgSLj7OeLfbn8216uOMDHuaZ6TEUBDN8Uz0ve8jAlKsP9CQFCSVoSNovdE-fs7c15MxEGHjDcNKLWonznximj8pDGZQjVdfK-7mG6P6z-lgVcLuYu5JcWU_PeEqIKg5llOaz-qeQ4LEDS4T1D2qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3F
    dismissed LLM, confidence 0.93 A test fixture RSA JWK string in a broker test script.
    Reasoning

    This is the same RSA JWK test fixture as in the library module, here in a broker test script. Test fixtures commonly carry key material like this, and nothing is decoded or executed.

  9. info warn → info by review encoding-base64 tests/broker-test.py:34:247

    base64-like blob (104 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

    qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3Fe11Xz8AEBl3anKFSJcTvlMnFtu3EpD-eiaHfTgRBU7CztGQqVbiQ", "e":"AQAB"}"""
    dismissed LLM, confidence 0.93 The tail of the RSA JWK test fixture in the broker test script.
    Reasoning

    This is the tail of the same JWK test fixture, a standard base64url key encoding in a test file.

  10. info warn → info by review encoding-base64 tests/test_ccs.py:26:22

    base64-like blob (123 bytes, compression ratio 0.93) (raw pass, confidence 0.60)

                    "client_info":  # MSAL asks for client_info, so it would be available
                    "eyJ1aWQiOiJhYTkwNTk0OS1hMmI4LTRlMGEtOGFlYS1iMzJlNTNjY2RiNDEiLCJ1dGlkIjoiNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjQ3In0",
                })
            self.assertEqual(
    dismissed LLM, confidence 0.92 A base64url-encoded client_info claim blob used as test input.
    Reasoning

    The value is a base64url-encoded JSON object (uid/utid claims) passed as client_info in a unit test. This is the standard MSAL client_info format, and the test asserts on it. It is not a payload.

  11. info warn → info by review encoding-base64 tests/test_e2e.py:802:35

    base64-like blob (78 bytes, compression ratio 1.14) (raw pass, confidence 0.60)

        _JWK1 = """{"kty":"RSA", "n":"2tNr73xwcj6lH7bqRZrFzgSLj7OeLfbn8216uOMDHuaZ6TEUBDN8Uz0ve8jAlKsP9CQFCSVoSNovdE-fs7c15MxEGHjDcNKLWonznximj8pDGZQjVdfK-7mG6P6z-lgVcLuYu5JcWU_PeEqIKg5llOaz-qeQ4LEDS4T1D2qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66l
    dismissed LLM, confidence 0.93 The RSA JWK test fixture reused in the end-to-end test file.
    Reasoning

    The end-to-end test repeats the same RSA JWK fixture seen in the library and broker test files. This is test data for key handling.

  12. info warn → info by review encoding-base64 tests/test_e2e.py:802:251

    base64-like blob (104 bytes, compression ratio 1.04) (raw pass, confidence 0.60)

    qWRGpAra4rJX1-kmrWmX_XIamq30C9EIO0gGuT4rc2hJBWQ-4-FnE1NXmy125wfT3NdotAJGq5lMIfhjfglDbJCwhc8Oe17ORjO3FsB5CLuBRpYmP7Nzn66lRY3Fe11Xz8AEBl3anKFSJcTvlMnFtu3EpD-eiaHfTgRBU7CztGQqVbiQ", "e":"AQAB"}"""
    dismissed LLM, confidence 0.93 The tail of the RSA JWK test fixture in the end-to-end test file.
    Reasoning

    This is the tail of the same JWK test fixture in the end-to-end test, a standard base64url key encoding.

  13. info encoding-base64 tests/test_e2e.py:833:82

    base64-like blob (68 bytes, compression ratio 0.90) (in comment) (raw pass, confidence 0.36)

            '6256c85f-0aad-4d50-b960-e6e9b21efe35/.default',  # Azure CLI's connectedk8s plugin uses this
            # https://github.com/Azure/azure-cli-extensions/pull/4468/files#diff-a47efa3186c7eb4f1176e07d0b858ead0bf4a58bfd51e448ee3607a5b4ef47f6R116
    ]
  14. info warn → info by review encoding-base64 tests/test_oidc.py:81:62

    base64-like blob (104 bytes, compression ratio 0.97) (raw pass, confidence 0.60)

    class TestIdToken(unittest.TestCase):
    EXPIRED_ID_TOKEN = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJpc3N1ZXIiLCJpYXQiOjE3MDY1NzA3MzIsImV4cCI6MTY3NDk0ODMzMiwiYXVkIjoiZm9vIiwic3ViIjoic3ViamVjdCJ9.wyWNFxnE35SMP6FpxnWZmWQAy4KD0No_Q1rUy5bNnLs"

    _EXPECTED_CLAIMS = {
    dismissed LLM, confidence 0.92 A test JWT constant representing an expired ID token.
    Reasoning

    This is a JWT with a header and claims (iss/iat/exp/aud/sub) and a signature, used as an EXPIRED_ID_TOKEN constant in an OIDC unit test. Its claims are plausible test values and show no sign of malicious use.

  15. info warn → info by review encoding-base64 tests/test_optional_thumbprint.py:15:1

    base64-like blob (128 bytes over 2 lines, compression ratio 1.02) (raw pass, confidence 0.60)

        test_private_key = """-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKj
MzEfYyjiWA4R4/M2bS1+fWIcPm15j7uo6xKvRr4PNx5bKMDFqMdW6/xfqFWX0nZK
-----END PRIVATE KEY-----"""
    likely benign LLM, confidence 0.88 A PEM private key test fixture embedded in a test file.
    Reasoning

    This is a PEM-armored private key constant in a test for optional thumbprint handling. The key text looks like a generated test value, and the file's purpose is consistent with fixture use. Hardcoded test keys are a known false positive for base64 detection.

  16. info warn → info by review encoding-base64 tests/test_optional_thumbprint.py:20:1

    base64-like blob (128 bytes over 2 lines, compression ratio 0.88) (raw pass, confidence 0.60)

        test_certificate = """-----BEGIN CERTIFICATE-----
MIIC5jCCAc6gAwIBAgIJALdYQVsVsNZHMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNV
BAMMC0V4YW1wbGUgQ0EwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjAW
-----END CERTIFICATE-----"""
    likely benign LLM, confidence 0.90 A PEM certificate test fixture in the same test file.
    Reasoning

    This is a PEM certificate test fixture (BEGIN CERTIFICATE with an example CA subject) in the same test file. It is standard test data and not an obfuscated payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/AzureAD/microsoft-authentication-library-for-python microsoft-authentication-library-for-python && cd microsoft-authentication-library-for-python
git checkout 1.39.0
disclude scan --severity info --diff 1.38.0 .