PyPI / pathspec / 1.1.1

pathspec 1.1.1

Source

https://github.com/cpburnz/python-pathspec

Tag scanned

v1.1.1

Compared with

v1.1.0 (0 signals introduced since)

Files

111 scanned, 20 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

3.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-21 22:07

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import dev/venv.sh:29:1

   `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

   # Activate venv.
   . "$venv/bin/activate"
   
   # Execute command.

   likely benign LLM, confidence 0.90 Dev helper script that sources the virtualenv activate script from a variable path.

   Reasoning

   Sourcing a venv activate script from a variable path is the standard virtualenv activation idiom in a dev helper; the path is derived from the project's own venv directory, not attacker-controlled input.

2. info warn → info by review dynamic-execution dev/venv.sh:32:1

   command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   # Execute command.
   "$@"

   likely benign LLM, confidence 0.88 Dev wrapper that executes the caller-supplied command after venv activation.

   Reasoning

   A wrapper that runs its arguments via "$@" is a normal pattern for dev tooling that executes a command inside the activated venv; the caller chooses the command, which is the expected design.

3. info warn → info by review payload-bytes-literal tests/test_03_gitignore_basic.py:522:4

   concatenated bytes literal contains 158 `\xNN` escapes (86% of content) — binary payload shape (ast pass, confidence 0.85)

   		expected = (
   			b'\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10'
   			b'\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f'
   			b' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\'

   likely benign LLM, confidence 0.93 Test fixture containing a sequential byte-value expected output for gitignore tests.

   Reasoning

   The bytes literal is a test fixture enumerating all byte values 0x00 through 0x7f in order, which is an expected sequence for testing gitignore handling of arbitrary bytes. No execution or decoding of the payload occurs.

4. info warn → info by review payload-bytes-literal tests/test_04_gitignore_spec.py:526:4

   concatenated bytes literal contains 158 `\xNN` escapes (86% of content) — binary payload shape (ast pass, confidence 0.85)

   		expected = (
   			b'\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10'
   			b'\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f'
   			b' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\'

   likely benign LLM, confidence 0.93 Test fixture containing a sequential byte-value expected output for gitignore spec tests.

   Reasoning

   Same sequential byte-value fixture as the sibling test file, used as expected test data for gitignore behavior. It is a deliberate test vector, not a dropper payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/cpburnz/python-pathspec python-pathspec && cd python-pathspec
git checkout v1.1.1
disclude scan --severity info --diff v1.1.0 .