PyPI / platformdirs / 4.13.5

platformdirs 4.13.5

Source

https://github.com/tox-dev/platformdirs

Tag scanned

4.13.5

Compared with

4.13.4 (0 signals introduced since)

Files

33 scanned, 6 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

6.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-20 00:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review path-command-shadow docs/howto.rst:267:5

   [embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)

       > set WIN_PD_OVERRIDE_LOCAL_APPDATA=X:\appdata
       > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
       X:\appdata\Acme\MyApp\Cache

   dismissed LLM, confidence 0.90 Documentation example of running python -c with platformdirs in a Windows shell.

   Reasoning

   This is a Windows console example in reStructuredText documentation showing a user running python -c with an environment variable set. The 'redirect' is a doc-parsing artifact of the '>' prompt markers, not a PATH hijack. No executable payload is present.

2. info warn → info by review obfuscated-command-name docs/howto.rst:268:5

   [embedded bash] command name contains 4 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)

       > python -c "from platformdirs import user_cache_dir; print(user_cache_dir('MyApp', 'Acme'))"
       X:\appdata\Acme\MyApp\Cache

   dismissed LLM, confidence 0.92 Windows path output in a documentation example, misread as an obfuscated command name.

   Reasoning

   The flagged 'backslash escapes' are Windows path separators in the example output (X:\appdata\Acme\MyApp\Cache) and the command itself is a plain, readable python invocation. The finding is a false positive from treating doc text as a shell command.

3. info warn → info by review dynamic-attribute src/platformdirs/testing.py:63:20

   reach-by-name through `vars` (ast pass, confidence 0.60)

       cls = platformdirs.PlatformDirs
       saved = {name: vars(cls)[name] for name in patches if name in vars(cls)}
       for name, value in patches.items():
           setattr(cls, name, value)

   likely benign LLM, confidence 0.80 Test helper that temporarily patches PlatformDirs attributes via setattr after saving originals.

   Reasoning

   This is a test helper in the platformdirs package that saves original class attributes via vars(), applies patches with setattr, and presumably restores them afterward. Dynamic attribute access of this kind is a standard mocking technique in test utilities and does not hide anything malicious.

4. info critical → info by review builtins-write tests/test_api.py:171:13

   `builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)

           try:
               builtins.__import__ = _fake_import  # ty: ignore[invalid-assignment]
               for name, _ in platformdirs_module_items:
                   del sys.modules[name]

   likely benign LLM, confidence 0.80 Test fixture that temporarily overrides builtins.__import__ to simulate import failures.

   Reasoning

   The test temporarily replaces builtins.__import__ with a fake importer to simulate platformdirs modules being unavailable, and clears them from sys.modules. This is a deliberate test isolation technique; the flagged code sits inside a setup/teardown pattern that restores the original import function.

5. info critical → info by review builtins-write tests/test_api.py:177:13

   `builtins.__import__ = ...` — patches a built-in for every importer of this module (ast pass, confidence 0.95)

               # restore original modules
               builtins.__import__ = builtin_import
               for name, module in platformdirs_module_items:
                   sys.modules[name] = module

   likely benign LLM, confidence 0.80 Restoration of builtins.__import__ and sys.modules after the import-simulation test.

   Reasoning

   This restores the original builtins.__import__ and reinstates sys.modules entries, which is the cleanup counterpart of the patch at line 171. The pair forms a balanced, scoped test pattern rather than persistent global tampering.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/tox-dev/platformdirs platformdirs && cd platformdirs
git checkout 4.13.5
disclude scan --severity info --diff 4.13.4 .