platformdirs 4.13.4

Source: https://github.com/tox-dev/platformdirs
Tag scanned: 4.13.4
Compared with: 4.13.3 (0 signals introduced since)
Files: 33 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 6.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-17 21:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review path-command-shadow docs/howto.rst:267:5

[embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
    > set WIN_PD_OVERRIDE_LOCAL_APPDATA=X:\appdata
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
dismissed LLM, confidence 0.93 RST how-to example showing platformdirs output via a python -c invocation.
Reasoning
This is a documentation example showing a user running python with a Windows environment variable set. The ast pass flagged the command name 'python' as a PATH-hijack setup, but the snippet is an ordinary illustrative command with no redirect, download, or payload. Nothing in the snippet suggests a shadowing attack.
info ~~warn~~ → info by review obfuscated-command-name docs/howto.rst:268:5

[embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)
```
    > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
    X:\appdata\Acme\MyApp\Cache
```
dismissed LLM, confidence 0.92 Documentation output line with a Windows cache path; the backslash count is a false positive from path syntax.
Reasoning
The flagged 'command name' is a Windows-style path fragment in a documentation output block, not a real escaped command. The backslashes are ordinary path separators in displayed output, so there is no command hiding.
info ~~warn~~ → info by review dynamic-attribute src/platformdirs/testing.py:63:20

reach-by-name through `vars` (ast pass, confidence 0.60)
```
    cls = platformdirs.PlatformDirs
    saved = {name: vars(cls)[name] for name in patches if name in vars(cls)}
    for name, value in patches.items():
        setattr(cls, name, value)
```
likely benign LLM, confidence 0.85 Test utility that saves and overrides PlatformDirs attributes via reflection.
Reasoning
testing.py is a test helper that temporarily patches PlatformDirs class attributes, saving originals via vars() and restoring them afterward. Reflective getattr/setattr is the normal way to build such a patching context manager. It has no network, exec, or persistence behaviour.
info ~~critical~~ → info by review builtins-write tests/test_api.py:171:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
        try:
            builtins.__import__ = _fake_import  # ty: ignore[invalid-assignment]
            for name, _ in platformdirs_module_items:
                del sys.modules[name]
```
likely benign LLM, confidence 0.82 Test code that swaps in a fake __import__ to simulate platformdirs import behaviour.
Reasoning
Within a test, the code temporarily replaces builtins.__import__ with a fake to simulate import failures, then removes the platformdirs modules from sys.modules. This is a common test technique. Although the override is process-wide, the snippet shows it scoped to the test and paired with restoration, so the critical severity looks overstated.
info ~~critical~~ → info by review builtins-write tests/test_api.py:177:13

`builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)
```
            # restore original modules
            builtins.__import__ = builtin_import
            for name, module in platformdirs_module_items:
                sys.modules[name] = module
```
likely benign LLM, confidence 0.85 Test cleanup that restores the original builtin import and sys.modules entries.
Reasoning
The same test fixture restores the original builtins.__import__ and re-populates sys.modules. The snippet shows the save-and-restore cleanup, which is the expected counterpart of the monkeypatch in a test, with no malicious payload or exfiltration.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tox-dev/platformdirs platformdirs && cd platformdirs
git checkout 4.13.4
disclude scan --severity info --diff 4.13.3 .