disclude.io

PyPI / oauthlib / 4.0.0

oauthlib 4.0.0

Source
https://github.com/oauthlib/oauthlib
Tag scanned
v4.0.0
Compared with
v3.3.1 (0 signals introduced since)
Files
229 scanned, 21 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 10 info
Scan time
7.4 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-22 02:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:468:10

    base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)

        expected_signature_hmac_sha256 = \
        'wdfdHUKXHbOnOGZP8WFAWMSAmWzN3EVBWWgXGlC/Eo4='

    expected_signature_hmac_sha512 = (
    likely benign LLM, confidence 0.96 Expected HMAC-SHA256 signature value in an OAuth1 test vector.
    Reasoning

    The blob is an expected HMAC-SHA256 signature constant in a unit test for an OAuth1 library. Test vectors like this are normal, and the raw base64 pattern alone is not evidence of obfuscation.

  2. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:471:10

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        expected_signature_hmac_sha512 = (
        'u/vlyZFDxOWOZ9UUXwRBJHvq8/T4jCA74ocRmn2ECnjUBTAeJiZIRU8hDTjS88Tz'
        '1fGONffMpdZxUkUTW3k1kg=='
    )
    likely benign LLM, confidence 0.96 Expected HMAC-SHA512 signature value in an OAuth1 test vector.
    Reasoning

    The split string is an expected HMAC-SHA512 signature constant used for assertions in an OAuth1 signature test suite. This is ordinary test data.

  3. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:597:1

    base64-like blob (816 bytes over 13 lines, compression ratio 0.80) (raw pass, confidence 0.60)

    -----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDk1/bxyS8Q8jiheHeYYp/4rEKJopeQRRKKpZI4s5i+UPwVpupG
AlwXWfzXwSMaKPAoKJNdu7tqKRniqst5uoHXw98gj0x7zamu0Ck1LtQ4c7pFMVah
5IYGhBi2E9ycNS329W27nJPWNCbESTu7snVlG8V8mfvGGg3xNjTMO7IdrwIDAQAB
    likely benign LLM, confidence 0.96 Embedded RSA private key used as a test fixture.
    Reasoning

    This is a PEM-encoded RSA private key in a test file for an OAuth library, consistent with published RFC 5849 test vectors. It is a known test key, not a live credential or an obfuscated payload.

  4. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:615:1

    base64-like blob (188 bytes over 3 lines, compression ratio 0.92) (raw pass, confidence 0.60)

    -----BEGIN RSA PUBLIC KEY-----
MIGJAoGBAOTX9vHJLxDyOKF4d5hin/isQomil5BFEoqlkjizmL5Q/BWm6kYCXBdZ
/NfBIxoo8Cgok127u2opGeKqy3m6gdfD3yCPTHvNqa7QKTUu1DhzukUxVqHkhgaE
GLYT3Jw1Lfb1bbuck9Y0JsRJO7uydWUbxXyZ+8YaDfE2NMw7sh2vAgMBAAE=
    likely benign LLM, confidence 0.96 Embedded RSA public key used as a test fixture.
    Reasoning

    This is a PEM-encoded RSA public key in a test fixture for an OAuth library. Public keys in tests are routine and carry no malicious signal.

  5. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:638:10

    9 rows of base64-like lines, lines 638-650 (first: base64-like blob (65 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

        expected_signature_rsa_sha1 = (
        'mFY2KOEnlYWsTvUA+5kxuBIcvBYXu+ljw9ttVJQxKduMueGSVPCB1tK1PlqVLK738'
        'HK0t19ecBJfb6rMxUwrriw+MlBO+jpojkZIWccw1J4cAb4qu4M81DbpUAq4j/1w/Q'
        'yTR4TWCODlEfN7Zfgy8+pf+TjiXfIwRC1jEWbuL1E='
    likely benign LLM, confidence 0.95 Expected RSA-SHA1 signature value in an OAuth1 test vector.
    Reasoning

    The split lines form an expected RSA-SHA1 signature constant in an OAuth1 test. This is standard test data in a signature-verification suite.

  6. info warn → info by review encoding-base64 tests/oauth1/rfc5849/test_signatures.py:704:1

    base64-like blob (812 bytes over 13 lines, compression ratio 0.79) (raw pass, confidence 0.60)

    -----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBgQDZcD/1OZNJJ6Y3QZM16Z+O7fkD9kTIQuT2BfpAOUvDfxzYhVC9
TNmSDHCQhr+ClutyolBk5jTE1/FXFUuHoPsTrkI7KQFXPP834D4gnSY9jrAiUJHe
DVF6wXNuS7H4Ueh16YPjUxgLLRh/nn/JSEj98gsw+7DP01OWMfWS99S7eQIDAQAB
    likely benign LLM, confidence 0.96 Embedded RSA private key used as a test fixture.
    Reasoning

    This is another PEM-encoded RSA private key in an OAuth test file, the same kind of fixture as the other key blocks. The context points to test data, not an attack payload.

  7. info warn → info by review encoding-base64 tests/oauth2/rfc6749/clients/test_service_application.py:20:1

    base64-like blob (816 bytes over 13 lines, compression ratio 0.80) (raw pass, confidence 0.60)

    -----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDk1/bxyS8Q8jiheHeYYp/4rEKJopeQRRKKpZI4s5i+UPwVpupG
AlwXWfzXwSMaKPAoKJNdu7tqKRniqst5uoHXw98gj0x7zamu0Ck1LtQ4c7pFMVah
5IYGhBi2E9ycNS329W27nJPWNCbESTu7snVlG8V8mfvGGg3xNjTMO7IdrwIDAQAB
    likely benign LLM, confidence 0.96 Embedded RSA private key in an OAuth2 client test.
    Reasoning

    This PEM RSA private key appears in an OAuth2 client test file. Test keys like this are common in authentication library test suites.

  8. info warn → info by review encoding-base64 tests/oauth2/rfc6749/clients/test_service_application.py:38:1

    base64-like blob (216 bytes over 4 lines, compression ratio 0.90) (raw pass, confidence 0.60)

    -----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDk1/bxyS8Q8jiheHeYYp/4rEKJ
opeQRRKKpZI4s5i+UPwVpupGAlwXWfzXwSMaKPAoKJNdu7tqKRniqst5uoHXw98g
j0x7zamu0Ck1LtQ4c7pFMVah5IYGhBi2E9ycNS329W27nJPWNCbESTu7snVlG8V8
    likely benign LLM, confidence 0.96 Embedded PEM public key in an OAuth2 client test.
    Reasoning

    This is a PEM public key block in an OAuth2 client test, consistent with a fixture for JWT or service-application testing. It is not an encoded dropper or obfuscated code.

  9. info warn → info by review encoding-base64 tests/oauth2/rfc6749/test_server.py:232:1

    base64-like blob (1592 bytes over 25 lines, compression ratio 0.77) (raw pass, confidence 0.60)

    -----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA6TtDhWGwzEOWZP6m/zHoZnAPLABfetvoMPmxPGjFjtDuMRPv
EvI1sbixZBjBtdnc5rTtHUUQ25Am3JzwPRGo5laMGbj1pPyCPxlVi9LK82HQNX0B
YK7tZtVfDHElQA7F4v3j9d3rad4O9/n+lyGIQ0tT7yQcBm2A8FEaP0bZYCLMjwMN
    likely benign LLM, confidence 0.96 Embedded RSA private key in an OAuth2 server test.
    Reasoning

    This PEM RSA private key sits in an OAuth2 server test file. It is a conventional test fixture and the base64 pattern is expected for PEM data.

  10. info warn → info by review encoding-base64 tests/oauth2/rfc6749/test_server.py:262:1

    base64-like blob (392 bytes over 7 lines, compression ratio 0.84) (raw pass, confidence 0.60)

    -----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6TtDhWGwzEOWZP6m/zHo
ZnAPLABfetvoMPmxPGjFjtDuMRPvEvI1sbixZBjBtdnc5rTtHUUQ25Am3JzwPRGo
5laMGbj1pPyCPxlVi9LK82HQNX0BYK7tZtVfDHElQA7F4v3j9d3rad4O9/n+lyGI
    likely benign LLM, confidence 0.96 Embedded PEM public key in an OAuth2 server test.
    Reasoning

    This is a PEM public key in an OAuth2 server test file, a routine fixture. The raw base64 detection reflects PEM formatting, not hidden code.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/oauthlib/oauthlib oauthlib && cd oauthlib
git checkout v4.0.0
disclude scan --severity info --diff v3.3.1 .