platformdirs 4.13.1

Source: https://github.com/tox-dev/platformdirs
Tag scanned: 4.13.1
Compared with: 4.13.0 (0 signals introduced since)
Files: 33 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 6.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 17:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review path-command-shadow docs/howto.rst:266:5

[embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    > set WIN_PD_OVERRIDE_LOCAL_APPDATA=X:\appdata
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
likely benign LLM, confidence 0.90 Documentation example showing a Windows command invocation of python with an environment variable.
Reasoning
The flagged line is a Windows cmd prompt example in an RST code block, showing a user running python -c to print a directory after setting an environment variable. The '>' is a shell prompt, not a redirect. The PATH-hijack signal is a false match on documentation prose.
info ~~warn~~ → info by review obfuscated-command-name docs/howto.rst:267:5

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
likely benign LLM, confidence 0.90 Doc example line whose Windows path backslashes triggered an escape-sequence heuristic.
Reasoning
The 'backslash escape sequences' are Windows path separators in the example output (X:\appdata\Acme\...) being misread as escapes in a command name. The snippet is ordinary documentation of a python one-liner and its output.
info ~~warn~~ → info by review dynamic-attribute src/platformdirs/testing.py:61:20

reach-by-name through `vars` (ast pass, confidence 0.60)
```
    cls = platformdirs.PlatformDirs
    saved = {name: vars(cls)[name] for name in patches if name in vars(cls)}
    for name, value in patches.items():
        setattr(cls, name, value)
```
likely benign LLM, confidence 0.85 Test utility that temporarily overrides PlatformDirs attributes and saves the originals for later restoration.
Reasoning
This is a test helper that saves original class attributes via vars(), applies patches with setattr, and then presumably restores them. This is a standard monkeypatch-and-restore pattern in a testing module, and the reflective access is what that pattern needs.
info ~~critical~~ → info by review builtins-write tests/test_api.py:171:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
        try:
            builtins.__import__ = _fake_import  # ty: ignore[invalid-assignment]
            for name, _ in platformdirs_module_items:
                del sys.modules[name]
```
likely benign LLM, confidence 0.80 Test code that temporarily swaps builtins.__import__ to simulate import behavior, then restores it.
Reasoning
Within a try block, the test replaces builtins.__import__ with a fake importer to simulate an import environment, then clears platformdirs modules from sys.modules. The paired restore at line 177 indicates a scoped test fixture rather than persistent malicious patching. The pattern is unusual but is a recognizable test technique.
info ~~critical~~ → info by review builtins-write tests/test_api.py:177:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
            # restore original modules
            builtins.__import__ = builtin_import
            for name, module in platformdirs_module_items:
                sys.modules[name] = module
```
likely benign LLM, confidence 0.80 Test cleanup that restores the original builtins.__import__ and sys.modules entries.
Reasoning
This is the restore half of the same test-scoped patch: builtins.__import__ is reset to the saved builtin_import and the platformdirs modules are reinserted into sys.modules. The restore confirms the patch is temporary and does not persist beyond the test.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tox-dev/platformdirs platformdirs && cd platformdirs
git checkout 4.13.1
disclude scan --severity info --diff 4.13.0 .