disclude.iopandas 3.0.6
- Source
- https://github.com/pandas-dev/pandas
- Tag scanned
v3.0.6- Compared with
v3.0.5(0 signals introduced since)- Files
- 1866 scanned, 605 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 60 info
- Scan time
- 26.4 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 41 of 41 warn and critical signals; 41 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-14 18:16
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
-
-
-
likely benign CI script that runs a test command taken from the PYTEST_CMD environment variable via sh -c.
Reasoning
sh -c on a variable is equivalent to eval, but PYTEST_CMD is a CI test-command variable set by the project's own pipeline; this is a common, legitimate pattern for running configurable test commands, though it is a minor injection surface if the variable is attacker-controlled.
-
⟨U+00A0⟩ df.columns.levels # original MultiIndexlikely benign Documentation file containing non-breaking spaces in indentation.Reasoning
A non-breaking space in RST indentation is a typical artifact of copy-pasting from rendered docs; it is harmless in documentation prose and code examples.
-
⟨U+00A0⟩ as indexing *both* axes, rather than into say the ``MultiIndex`` for the rows.likely benign Non-breaking space in RST prose indentation of the advanced indexing guide.Reasoning
Same copy-paste whitespace artifact in pandas user guide prose; no executable impact.
-
⟨U+00A0⟩ **not** : ⟨U+00A0⟩ .. -::likely benign Non-breaking space in RST around an embedded python code-block.Reasoning
Non-breaking space before a code-block directive in documentation; cosmetic copy artifact with no code effect.
-
⟨U+00A0⟩ You should **not** do this: ⟨U+00A0⟩likely benign Non-breaking space in RST documentation near a code example.Reasoning
Same cosmetic whitespace artifact in docs; the embedded example is documentation text only.
-
-
-
# pragma: no coverlikely benign Dynamic __import__ of pandas' hard dependency names inside a version-check loop.Reasoning
pandas' __init__ imports its required dependencies dynamically by name from a fixed list in a version-check loop, re-raising ImportError with a helpful message. This is a standard, legitimate dependency check.
-
# https://stackoverflow.com/questions/17407119/python-inspect-stack-is-slow = = # type: ignore[union-attr]likely benign Test helper walking the call stack via inspect.currentframe to find the warning's caller.Reasoning
Walking up the stack a fixed number of frames to locate the caller for warning assertions is a standard testing utility technique, with a comment explaining it.
-
""" frame = sys._getframe(2) for v in frame.f_locals.values(): if v is obj:likely benign Helper reading caller's local variables via sys._getframe for scope resolution.Reasoning
sys._getframe(2) to access caller locals in a pandas helper is a known, benign introspection pattern used for resolving variable scope in query/eval-like utilities.
-
= =likely benign Expression evaluation within pandas' computation engine using eval on parsed operator nodes.Reasoning
pandas' query/eval engine intentionally evaluates parsed expression nodes via eval; this is the core documented design of DataFrame.eval, not injected malicious code.
-
=likely benign Scope resolver using sys._getframe to capture the calling frame's variables for eval.Reasoning
Fetching a frame at a configured level to capture variable scope is the standard mechanism for pandas eval scope resolution.
-
# makes sure that we can capture variable scope =likely benign Scope builder calling inspect.stack to capture variables for query evaluation.Reasoning
inspect.stack is used by pandas' eval scope builder to capture caller variables; a known, legitimate, if slow, technique.
-
]: =likely benign Reads named local keyword arguments via vars() to forward to a Styler method.Reasoning
vars()[kw_name] reads local variables by name for a fixed list of styler keyword arguments; it is a local, non-malicious lookup with no external input reaching execution.
-
: =likely benign Byte-string constant defining the SAS7BDAT file magic header.Reasoning
The bytes literal is the SAS file magic number and header constants, a well-known file-format signature. It is a legitimate constant table, not a dropper payload.
-
assert ==likely benign Test code evaluating a generated expression string to validate query results.Reasoning
In a test, eval is applied to a locally constructed expression string to compare against pandas' result; it is test code with no external input.
-
= = assert ==likely benign Test helper uses eval on a test-generated expression string to compute the expected result.Reasoning
Test code evaluating expressions generated by the test suite itself to compare against pandas eval results; eval of a locally constructed test string is a standard pattern in pandas tests and not attacker-controlled.
-
= = assert ==likely benign Test computes expected value by eval-ing a generated test expression.Reasoning
Same pattern as the sibling finding: eval of a locally generated test expression for result comparison in a pandas test module.
-
= = =likely benign Test resolves a random-state constructor by name via eval for sampling comparison.Reasoning
eval(func_str)(arg) resolves a numpy/random-state constructor name from a parametrized test list; a test-only round-trip with no external input.
-
= =likely benign Test evaluates a parametrized constructor string to build a random state for comparison.Reasoning
Same parametrized eval of a constructor name in a test; no untrusted input reaches it.
-
, -
, -
= =likely benign Test checks that repr of an Index round-trips through eval.Reasoning
Round-trip test eval(repr(idx)) verifying that the repr is evaluable; a deliberate pattern in pandas tests operating on known objects.
-
info
warn→ info by reviewdynamic-executionpandas/tests/indexes/categorical/test_category.py:207:31# formattinglikely benign Test verifies repr round-trip of a CategoricalIndex via eval.Reasoning
eval(repr(ci)) round-trip assertion on a locally constructed CategoricalIndex in a pandas test; benign.
-
likely benign Test evaluates repr of a MultiIndex, expecting a TypeError in the surrounding block.
Reasoning
Repr round-trip inside a pytest.raises block for MultiIndex in a test module; benign test code.
-
=likely benign Test checks that eval of an index repr reproduces the index.Reasoning
Repr round-trip equality check on a locally built index in a pandas numeric index test.
-
=likely benign Test evaluates a RangeIndex repr string to verify it reconstructs the index.Reasoning
eval of a repr string for RangeIndex in a test to verify the repr; local test data only.
-
=likely benign Test evaluates a RangeIndex repr string to verify reconstruction.Reasoning
Same repr round-trip test pattern for RangeIndex; benign.
-
=likely benign Test checks eval(repr(index)) equals the index.Reasoning
Repr round-trip on a fixture index in a pandas test; no external input.
-
=likely benign Test verifies repr of a simple index round-trips via eval.Reasoning
Repr round-trip on a fixture index inside a pandas test module; benign.
-
= -
= = -
# see gh-15086. -
info
warn→ info by reviewframe-introspectionpandas/tests/io/parser/common/test_common_basic.py:687:5=likely benign Test installs a no-op sys profile hook around a CSV read call and then clears it.Reasoning
Temporarily setting a no-op profile hook around a parser call in a test to exercise profiling code paths; sys.setprofile is used legitimately for profiling tests and the lambda does nothing harmful.
-
info
warn→ info by reviewframe-introspectionpandas/tests/io/parser/common/test_common_basic.py:689:5= =likely benign A pandas test resets the profiling hook via sys.setprofile(None) after a read call.Reasoning
sys.setprofile(None) is used to clear a profiler hook installed around a parser call in a test, a common pattern for checking parser behavior; clearing a profile hook is not malicious and the surrounding code is a normal pandas test.
-
== : return == : return -
== : return == : return -
# PR #25040 wide unicode wasn't copied correctly on PY3 on windows -
, , , , -
, , , , -
} = = = -
info
warn→ info by reviewdynamic-executionpandas/tests/scalar/timestamp/test_constructors.py:690:26assert == assert == # This should be 2013-11-01 05:00 in UTClikely benign Test checks that repr of a Timestamp round-trips through eval.Reasoning
eval(repr(result)) is a round-trip repr test in pandas' Timestamp test suite; the input is the object's own repr, not attacker-controlled data.
-
info
warn→ info by reviewdynamic-executionpandas/tests/scalar/timestamp/test_constructors.py:698:26assert == assert == # GH11708likely benign Test evaluates repr of a Timestamp to verify round-tripping.Reasoning
Same round-trip repr test pattern using eval on the object's own repr in a test file; benign.
-
info
warn→ info by reviewdynamic-executionpandas/tests/scalar/timestamp/test_constructors.py:707:26assert == assert == # This should be 2015-11-18 10:00 in UTClikely benign Test evaluates repr of a Timestamp to verify round-tripping.Reasoning
Same benign round-trip repr test using eval on self-generated repr output.
-
info
warn→ info by reviewdynamic-executionpandas/tests/scalar/timestamp/test_constructors.py:715:26assert == assert ==likely benign Test evaluates repr of a Timestamp to verify round-tripping.Reasoning
Same benign round-trip repr test using eval on self-generated repr output.
-
assert not in assert == =likely benign Test evaluates repr of a Timestamp to check round-trip equality.Reasoning
eval of repr of a Timestamp in a formatting test; the input is locally generated and the pattern is standard in pandas tests.
-
assert not in assert ==likely benign Test evaluates repr of a timezone-aware Timestamp.Reasoning
Same benign repr round-trip eval in a timezone repr test.
-
= assert ==likely benign Test evaluates repr of a Timestamp with a UTC offset.Reasoning
eval of the repr of a locally constructed Timestamp with UTC offset in a test; benign.
-
assert ==likely benign Test evaluates repr of pre-1900 Timestamps in a loop.Reasoning
eval(repr(z)) over a list of pre-1900 timestamps in a test; inputs are test-controlled and benign.
-
, -
, -
likely benign A long random-looking string literal in a pandas hashing test fixture.
Reasoning
A long string literal in a hashing test is test fixture data (expected hash inputs or values), not an executable payload; the raw base64-like heuristic fires on random-looking test strings and such raw matches have high false-positive rates.
-
likely benign A long random-looking string literal in a pandas hashing test fixture.
Reasoning
Same pattern: a random-looking string fixture in a hashing test, flagged by the raw pass heuristic; no decoding or execution is shown.
-
# https://stackoverflow.com/questions/17407119/python-inspect-stack-is-slow : | None = = 0likely benign Pandas utility uses inspect.currentframe to walk the stack for warning attribution.Reasoning
inspect.currentframe is used in pandas to locate the caller's stack frame for emitting warnings with the correct stacklevel, a well-known legitimate idiom.
-
likely benign Pandas dev script dispatches a validation function by name looked up in globals() from a CLI argument.
Reasoning
globals().get with args.validation_type is a dispatch table lookup by name for a validation function in a pandas developer script. The input comes from CLI args choosing among validators; it is a legitimate dynamic dispatch pattern, not obfuscation. Minor risk only if validation_type were attacker-controlled, which is not the case for a local dev script.
-
likely benign A stray zero-width space inside a sentence of a pandas community blog post.
Reasoning
A single U+200B zero-width space in prose of a blog post about a pandas mentorship grant. This is a typical copy-paste artifact from word processors or web editors and carries no executable or hidden payload in a markdown article.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&