disclude.iopillow 13.0.0
- Source
- https://github.com/python-pillow/Pillow
- Tag scanned
13.0.0- Compared with
12.3.0(4 signals introduced since)- Files
- 600 scanned, 1156 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 61 info
- Scan time
- 36.6 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 56 of 56 warn and critical signals; 56 demoted to info.
- Disclude version
- 4.1.0
- Scanned (UTC)
- 2026-10-21 22:59
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
b b ), # 16x16 strip with duplicatedlikely benign Base64-encoded test image bytes in a libtiff test.Reasoning
Base64 blob inside a test fixture for a TIFF image; it is raw image data in a test, a common pattern.
-
info
warn→ info by reviewidentifier-confusable-collisionsrc/libImaging/Draw.c:248:9new in this releaseint x1, int y1, int ink, point_handler point,dismissed Parameter name y1 flagged by the confusable heuristic.Reasoning
Standard coordinate parameter naming in a line-drawing function; no homoglyph or hidden characters.
-
info
warn→ info by reviewidentifier-confusable-collisionsrc/libImaging/Mode.c:150:6new in this release= , = , = , = ,dismissed Pillow rawmode table entries for L-mode formats with confusable-looking suffixes.Reasoning
IMAGING_RAWMODE_L_1 and IMAGING_RAWMODE_L_2I are ordinary enum names mapping to format strings such as L;1 and L;2I. The collision is a naming artifact of Pillow's mode-table conventions, and the code is a plain data table.
-
info
warn→ info by reviewidentifier-confusable-collisionsrc/libImaging/Mode.h:148:5new in this releaseIMAGING_RAWMODE_LX, IMAGING_RAWMODE_L_1, IMAGING_RAWMODE_L_16, IMAGING_RAWMODE_L_16B,dismissed Pillow header enum entries for L-mode rawmode variants.Reasoning
These are ordinary enum members for L-mode rawmodes, with a comment-free declaration list typical of a C header. No executable or hidden behaviour is present.
-
=likely benign Hand-built TIFF byte fixture in a metadata test.Reasoning
Bytes literal with \x escapes is a TIFF file header built in-memory for a metadata test, expected for binary format testing.
-
=likely benign Serialized pickle fixture for a PIL PngImageFile in a test.Reasoning
Pickle bytes for a PNG image plugin used in a pickle round-trip test; a fixed literal, not attacker-controlled at runtime, consistent with testing pickling of PIL objects.
-
if ; then LIBAVIF_CMAKE_FLAGS+=(-DAVIF_CODEC_AOM=SYSTEM) HAS_ENCODER=1 -
if ; then LIBAVIF_CMAKE_FLAGS+=(-DAVIF_CODEC_DAV1D=SYSTEM) HAS_DECODER=1 -
if ; then LIBAVIF_CMAKE_FLAGS+=(-DAVIF_CODEC_LIBGAV1=SYSTEM) HAS_DECODER=1 -
if ; then LIBAVIF_CMAKE_FLAGS+=(-DAVIF_CODEC_RAV1E=SYSTEM) HAS_ENCODER=1 -
if ; then LIBAVIF_CMAKE_FLAGS+=(-DAVIF_CODEC_SVT=SYSTEM) HAS_ENCODER=1 -
}: =likely benign globals() lookup in setup.py to find a dependency root.Reasoning
Looking up a root object by name in globals() in setup.py is a configuration-discovery pattern for locating optional dependencies; low risk in a build script but worth a glance.
-
=likely benign Dynamic assignment of compression constants into module namespace.Reasoning
Populates module attributes from a compression dictionary via vars(); a standard way to define constants dynamically, with fixed keys.
-
likely benign Embedded base64 PNG sample in ImageFont documentation.
Reasoning
Base64 blob inside a docstring or doctest showing an embedded PNG image; a documentation/test artifact, not executed.
-
=likely benign compile() of an expression for the ImageMath evaluator.Reasoning
ImageMath compiles user-supplied expression strings for its documented eval-style math API; intended but a real dynamic-execution surface, though restricted by a scanning step.
-
# nosec return 1likely benign os.system call launching an external image viewer.Reasoning
Runs a viewer command built from get_command at runtime, with a nosec marker; the command comes from the library's own viewer configuration and file path, which is expected for an image viewer, though it is a shell invocation with variable input.
-
= =likely benign FlateDecode stream decompression in the PDF parser.Reasoning
zlib decompression of PDF FlateDecode streams is the core function of a PDF parser; processing input data, not hidden payload execution.
-
= rb = rb = rb = rblikely benign Regex character classes for PDF whitespace and delimiters.Reasoning
Octal escapes in regex character classes for PDF whitespace and delimiters; standard PDF syntax definitions.
-
= rb = rb = rb = + blikely benign Regex character class for PDF whitespace and hex characters.Reasoning
Same PDF whitespace regex character class definitions as neighboring lines; legitimate.
-
= rb = rb = + b = + blikely benign PDF whitespace regex constant definitions.Reasoning
PDF whitespace regex definitions with octal escapes; legitimate parser constants.
-
= =likely benign Size-limited zlib decompression for PNG text chunks.Reasoning
Bounded zlib decompression of PNG text chunks with MAX_TEXT_CHUNK limit, a safe-decompression helper; standard PNG handling.
-
# default palette taken from piffo 0.93 by Hans Häggström b b blikely benign Default colour palette for the WAL image format, embedded as a bytes literal.Reasoning
The bytes literal is a 256-entry RGB palette (three bytes per colour, ramping smoothly) and the comment credits its source. Palette data written as escapes is a normal way to embed constants in an image-format decoder, so this is not an obfuscated payload.
-
b b b blikely benign Continuation of the WAL default palette byte table.Reasoning
This is a continuation of the same palette table. The values are monotonic-ish colour components with no decoding step, so the raw entropy signal reflects ordinary image data.
-
b b b blikely benign Further rows of the WAL palette constant.Reasoning
Same palette byte table in the same file; the escape runs are constant data consumed directly as bytes, with no execution or decoding path.
-
b b b blikely benign More rows of the WAL palette constant.Reasoning
Continuation of the static palette literal. Nothing in the snippet decodes or executes these bytes.
-
b b b blikely benign Palette rows in the WAL default colour table.Reasoning
Another static palette row. The byte values are plain colour data, consistent with a legitimate image format default.
-
b b b blikely benign Palette rows of the WAL colour table.Reasoning
Static palette data that is part of the same literal. No dynamic behaviour appears in the snippet.
-
b b b )likely benign Final rows of the WAL default palette.Reasoning
Closing rows of the same palette literal, which is a plain constant in an image decoder.
-
b b )likely benign Tail of the WAL palette literal.Reasoning
Last palette row; the literal is static data and the file is a standard Pillow image plugin.
-
return Truedismissed Availability check that imports an optional dependency by name.Reasoning
Pillow's feature-check helper imports an optional module by name to test whether it is installed, catching ModuleNotFoundError. The module name comes from internal callers with fixed names, so this is a standard availability probe.
-
returndismissed Fetches the version of an optional library for feature reporting.Reasoning
Reads a module's version attribute via __import__ with a fixed fromlist. This is a version-reporting helper for optional libraries, not a hidden execution path.
-
= returndismissed Internal feature-flag lookup through a dynamic import.Reasoning
Imports the PIL package's internal module and retrieves a flag attribute, guarded by ModuleNotFoundError. This is internal feature detection in a well-known library.
-
returndismissed Version lookup for an optional dependency.Reasoning
Same version-lookup helper pattern as earlier in the file, applied to optional modules. Benign.
-
; func = ; iflikely benign Runtime symbol resolution for Tk functions in the imaging extension.Reasoning
Pillow's Tk bridge resolves Tk and Tcl entry points at runtime with dlsym so it can work against whichever Tk library is loaded. The symbol names are fixed internal names, which is a standard way to bind optional shared-library functions.
-
/* Try loading from the main program namespace first */ main_program = ; iflikely benign Loads Tk symbols from the main program or a Tk shared library.Reasoning
Opens the main program's namespace with dlopen(NULL), then falls back to loading the Tk library. This is a common pattern for locating Tk symbols at runtime and the path is not attacker-controlled in this snippet.
-
} tkinter_lib = ; iflikely benign dlopen of the tkinter library at a runtime-computed path in Pillow's Tk imaging code.Reasoning
This is the Pillow Tk integration loading the tkinter shared library by a computed filename via dlopen, a common pattern for locating a platform-specific extension module. The path is derived from the Python installation, not attacker-controlled input in the snippet, so it is a legitimate dynamic load.
-
static struct ImagingAccessInstance accessors =dismissed Ordinary Pillow mode-constant names that the confusable heuristic flags due to 0/O and 1/l/I similarity.Reasoning
Identifiers like IMAGING_MODE_1 and IMAGING_MODE_L differ only in ordinary characters; the skeleton collision reflects the normal use of uppercase names like MODE and digits in C macros. No invisible or homoglyph characters are involved, so this is a false positive from the token heuristic.
-
if else ifdismissed Mode constant comparisons flagged by the confusable-identifier heuristic.Reasoning
Standard IMAGING_MODE_1 and IMAGING_MODE_L constant comparisons; the skeleton collision is an artifact of uppercase letters and digit 1 in ASCII names.
-
int d; int x0, y0; int xmin, ymin, xmax, ymax; float dx;dismissed Coordinate variables xo and yo flagged by the confusable heuristic.Reasoning
Plain variable names xo and yo in a drawing routine; the collision comes from lowercase o being treated as confusable with 0. Ordinary coordinate naming.
-
int d; int x0, y0; int xmin, ymin, xmax, ymax; float dx;dismissed Variable yo flagged by the confusable heuristic.Reasoning
Same as the other xo/yo case; ordinary coordinate identifier naming in a graphics routine.
-
static inline voiddismissed Coordinate parameter name in hline8 flagged by the confusable heuristic.Reasoning
Parameter names x0/y0 and x1 in a horizontal line routine; the collision is a generic artifact of digit and letter similarity.
-
int32_t py, pl, pr; int32_t cy, cl, cr; int8_t bufcnt; int8_t finished;dismissed Array identifier cy flagged by the confusable heuristic.Reasoning
Ordinary array identifiers cy/cl/cr in a drawing routine; the collision is a heuristic false positive.
-
voiddismissed Angle parameter al flagged by the confusable heuristic.Reasoning
Parameter names al/ar in normalize_angles are ordinary; the skeleton match is spurious.
-
ifdismissed Mode constant comparisons flagged by the confusable heuristic.Reasoning
Standard IMAGING_MODE constant comparisons in a mode check; no confusable homoglyphs present.
-
Imaging imIn, int x0, int y0, int x1,dismissed Coordinate parameter xo flagged by the confusable heuristic.Reasoning
Ordinary coordinate parameters x0 and x1 in a geometry function; false positive from digit/letter similarity.
-
int x0, int y0, int x1, int y1,dismissed Coordinate parameter yo flagged by the confusable heuristic.Reasoning
Ordinary coordinate parameters y0 and y1 in a geometry function; false positive.
-
likely benign Portable type alias macro for float in Pillow's platform header.
Reasoning
Pillow's ImPlatform.h defines portable FLOAT32 and FLOAT64 type aliases to float and double; this is a standard typedef-style macro for cross-platform sized types, not malicious.
-
likely benign Portable type alias macro for double in Pillow's platform header.
Reasoning
Same portable FLOAT64 alias to double in the platform header; legitimate type portability definition.
-
= , = , = , = , = , = ,dismissed Mode name lookup table flagged by the confusable heuristic.Reasoning
Mode name table entries using IMAGING_MODE constants; the skeleton collision is a heuristic artifact of the uppercase names.
-
= , = , = ,dismissed Raw mode name table flagged by the confusable heuristic.Reasoning
Raw-mode name table using IMAGING_RAWMODE constants; the collision is a heuristic false positive from ordinary ASCII identifiers.
-
= , = , = ,dismissed Pillow rawmode table entries for 1-bit pixel formats whose names differ only in confusable characters.Reasoning
The two identifiers are distinct, legitimately named rawmode enum entries (1;8 and 1;I) in Pillow's pixel-mode table. Their visual similarity comes from the I/1/l naming convention, not from any attempt to hide an identifier. Nothing here is executable or obfuscated.
-
IMAGING_MODE_1, IMAGING_MODE_CMYK, IMAGING_MODE_F,dismissed Enum declarations for Pillow image modes in a C header.Reasoning
IMAGING_MODE_1 and a neighbouring mode constant are standard enum members of a well-known imaging library header. The skeleton match is a coincidence of short identifier names.
-
// Non-rawmode aliases. IMAGING_RAWMODE_1, IMAGING_RAWMODE_CMYK, IMAGING_RAWMODE_F,dismissed Pillow header enum entries for rawmode aliases such as IMAGING_RAWMODE_1 and IMAGING_RAWMODE_CMYK.Reasoning
The flagged names are documented as non-rawmode aliases in a header comment, with plain enum syntax. Nothing suggests concealment.
-
// Rawmodes IMAGING_RAWMODE_1_8, IMAGING_RAWMODE_1_I, IMAGING_RAWMODE_1_IR,dismissed Pillow header enum entries for 1-bit rawmode variants.Reasoning
These are documented rawmode enum members with ordinary names. The identifier skeleton collision is a false positive from the confusability heuristic.
-
/* bilevel */ , , ,dismissed Pillow pack-function table rows for bilevel modes.Reasoning
The table maps IMAGING_MODE_1 and IMAGING_RAWMODE_1_I to packing functions in a standard pack table. The shared visual skeleton is a naming coincidence in the source.
-
/* bilevel */ , , ,dismissed Pillow pack-function table entries for bilevel rawmodes.Reasoning
The flagged identifiers are rawmode constants in a plain data table of pack functions, a standard structure in this library. The confusable match is a heuristic false positive.
-
ifdismissed Storage initialization branch for 1-bit images in Pillow.Reasoning
This is an ordinary mode comparison, if (mode == IMAGING_MODE_1), setting band and pixel sizes for 1-bit images. It is standard, legitimate control flow.
-
static voiddismissed Pillow static unpack function for 1-bit numpy boolean images.Reasoning
The flagged token is the function name unpack18 together with a comment mentioning a numpy boolean '|b1' format. The collision comes from the digit and letter pair in the name and comment, not from any hidden code.
-
/* bilevel */ , , ,dismissed Pillow unpack-function table rows for bilevel modes.Reasoning
The unpack table rows pair IMAGING_MODE_1 with rawmode constants, a normal data table. The skeleton collision reflects naming conventions only.
-
/* bilevel */ , , ,dismissed Pillow unpack-function table entries for bilevel rawmodes.Reasoning
These rawmode identifiers index unpack functions in a standard table. The confusable-collision signal is a false positive from the heuristic.
-
, , ,dismissed Pillow unpack-function table entries for 1-bit and 8-bit rawmode variants.Reasoning
The entries map 1-bit and 8-bit rawmode identifiers to unpack functions in an ordinary table. Nothing indicates obfuscation or malicious behaviour.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&