disclude.io

PyPI / oauthlib / 4.0.0

oauthlib 4.0.0

Source
https://github.com/oauthlib/oauthlib
Tag scanned
v4.0.0
Compared with
v3.3.1 (0 signals introduced since)
Files
229 scanned, 21 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 10 info
Scan time
6.9 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version
4.0.0
Scanned (UTC)
2026-10-14 18:32

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:468:10

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        expected_signature_hmac_sha256 = \
        'wdfdHUKXHbOnOGZP8WFAWMSAmWzN3EVBWWgXGlC/Eo4='

    expected_signature_hmac_sha512 = (
    likely benign LLM, confidence 0.95 Expected HMAC-SHA256 signature test vector, base64-encoded.
    Reasoning

    The snippet is a base64 string that the surrounding variable name identifies as an expected HMAC-SHA256 signature in a test. Test vectors like this are expected in an OAuth signature test suite and are not obfuscation.

  2. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:471:10

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        expected_signature_hmac_sha512 = (
        'u/vlyZFDxOWOZ9UUXwRBJHvq8/T4jCA74ocRmn2ECnjUBTAeJiZIRU8hDTjS88Tz'
        '1fGONffMpdZxUkUTW3k1kg=='
    )
    likely benign LLM, confidence 0.95 Expected HMAC-SHA512 signature test vector, split across string literals.
    Reasoning

    The snippet is a base64-encoded expected HMAC-SHA512 signature assigned to a test variable. This is a normal test fixture for verifying signature output.

  3. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:597:1

    base64-like blob (816 bytes over 13 lines, compression ratio 0.80) (raw pass, confidence 0.60)

    -----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDk1/bxyS8Q8jiheHeYYp/4rEKJopeQRRKKpZI4s5i+UPwVpupG
AlwXWfzXwSMaKPAoKJNdu7tqKRniqst5uoHXw98gj0x7zamu0Ck1LtQ4c7pFMVah
5IYGhBi2E9ycNS329W27nJPWNCbESTu7snVlG8V8mfvGGg3xNjTMO7IdrwIDAQAB
    likely benign LLM, confidence 0.93 Embedded RSA private key in PEM format used for signature tests.
    Reasoning

    The snippet is a PEM-formatted RSA private key in a signature test file. Test suites for RSA-SHA signing commonly embed throwaway keys, and the raw pass flags base64 content by design.

  4. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:615:1

    base64-like blob (188 bytes over 3 lines, compression ratio 0.92) (raw pass, confidence 0.60)

    -----BEGIN RSA PUBLIC KEY-----
MIGJAoGBAOTX9vHJLxDyOKF4d5hin/isQomil5BFEoqlkjizmL5Q/BWm6kYCXBdZ
/NfBIxoo8Cgok127u2opGeKqy3m6gdfD3yCPTHvNqa7QKTUu1DhzukUxVqHkhgaE
GLYT3Jw1Lfb1bbuck9Y0JsRJO7uydWUbxXyZ+8YaDfE2NMw7sh2vAgMBAAE=
    likely benign LLM, confidence 0.93 Embedded RSA public key in PEM format used for signature verification tests.
    Reasoning

    The snippet is a PEM-formatted RSA public key. Public keys embedded in test files for verifying signatures are routine and not malicious.

  5. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:638:10

    9 rows of base64-like lines, lines 638-650 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

        expected_signature_rsa_sha1 = (
        'mFY2KOEnlYWsTvUA+5kxuBIcvBYXu+ljw9ttVJQxKduMueGSVPCB1tK1PlqVLK738'
        'HK0t19ecBJfb6rMxUwrriw+MlBO+jpojkZIWccw1J4cAb4qu4M81DbpUAq4j/1w/Q'
        'yTR4TWCODlEfN7Zfgy8+pf+TjiXfIwRC1jEWbuL1E='
    likely benign LLM, confidence 0.95 Expected RSA-SHA1 signature test vector split across lines.
    Reasoning

    The snippet is a multi-line base64 string assigned to an expected RSA-SHA1 signature variable in a test. This is a normal test vector.

  6. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:704:1

    base64-like blob (812 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

    -----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBgQDZcD/1OZNJJ6Y3QZM16Z+O7fkD9kTIQuT2BfpAOUvDfxzYhVC9
TNmSDHCQhr+ClutyolBk5jTE1/FXFUuHoPsTrkI7KQFXPP834D4gnSY9jrAiUJHe
DVF6wXNuS7H4Ueh16YPjUxgLLRh/nn/JSEj98gsw+7DP01OWMfWS99S7eQIDAQAB
    likely benign LLM, confidence 0.93 Embedded RSA private key in PEM format for signature tests.
    Reasoning

    The snippet is a PEM-formatted RSA private key in a signature test file. This matches the test-fixture key pattern and the raw base64 flag is expected for PEM content.

  7. info warn → info by review encoding-base64 tests/oauth2/rfc6749/clients/test_service_application.py:20:1

    base64-like blob (816 bytes over 13 lines, compression ratio 0.80) (raw pass, confidence 0.60)

    -----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDk1/bxyS8Q8jiheHeYYp/4rEKJopeQRRKKpZI4s5i+UPwVpupG
AlwXWfzXwSMaKPAoKJNdu7tqKRniqst5uoHXw98gj0x7zamu0Ck1LtQ4c7pFMVah
5IYGhBi2E9ycNS329W27nJPWNCbESTu7snVlG8V8mfvGGg3xNjTMO7IdrwIDAQAB
    likely benign LLM, confidence 0.93 Embedded RSA private key in PEM format for service application client tests.
    Reasoning

    The snippet is a PEM RSA private key in a client test file for service-application authentication. Test keys in test suites are expected and the base64 flag is a raw-pass false positive.

  8. info warn → info by review encoding-base64 tests/oauth2/rfc6749/clients/test_service_application.py:38:1

    base64-like blob (216 bytes over 4 lines, compression ratio 0.90) (raw pass, confidence 0.60)

    -----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDk1/bxyS8Q8jiheHeYYp/4rEKJ
opeQRRKKpZI4s5i+UPwVpupGAlwXWfzXwSMaKPAoKJNdu7tqKRniqst5uoHXw98g
j0x7zamu0Ck1LtQ4c7pFMVah5IYGhBi2E9ycNS329W27nJPWNCbESTu7snVlG8V8
    likely benign LLM, confidence 0.93 Embedded PEM public key in service application client tests.
    Reasoning

    The snippet is a PEM public key in a client test file. Public keys in test fixtures are routine and not a security concern.

  9. info warn → info by review encoding-base64 tests/oauth2/rfc6749/test_server.py:232:1

    base64-like blob (1592 bytes over 25 lines, compression ratio 0.77) (raw pass, confidence 0.60)

    -----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA6TtDhWGwzEOWZP6m/zHoZnAPLABfetvoMPmxPGjFjtDuMRPv
EvI1sbixZBjBtdnc5rTtHUUQ25Am3JzwPRGo5laMGbj1pPyCPxlVi9LK82HQNX0B
YK7tZtVfDHElQA7F4v3j9d3rad4O9/n+lyGIQ0tT7yQcBm2A8FEaP0bZYCLMjwMN
    likely benign LLM, confidence 0.93 Embedded RSA private key in PEM format for OAuth2 server tests.
    Reasoning

    The snippet is a PEM RSA private key in an OAuth2 server test file. Server tests commonly use throwaway keys to exercise JWT or signing paths, so this is a test fixture.

  10. info warn → info by review encoding-base64 tests/oauth2/rfc6749/test_server.py:262:1

    base64-like blob (392 bytes over 7 lines, compression ratio 0.84) (raw pass, confidence 0.60)

    -----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6TtDhWGwzEOWZP6m/zHo
ZnAPLABfetvoMPmxPGjFjtDuMRPvEvI1sbixZBjBtdnc5rTtHUUQ25Am3JzwPRGo
5laMGbj1pPyCPxlVi9LK82HQNX0BYK7tZtVfDHElQA7F4v3j9d3rad4O9/n+lyGI
    likely benign LLM, confidence 0.93 Embedded PEM public key in OAuth2 server tests.
    Reasoning

    The snippet is a PEM public key in an OAuth2 server test file, matching the test-fixture key pattern. The base64 flag is a raw-pass false positive.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/oauthlib/oauthlib oauthlib && cd oauthlib
git checkout v4.0.0
disclude scan --severity info --diff v3.3.1 .