PyPI / playwright / 1.64.1

playwright 1.64.1

Source

https://github.com/microsoft/playwright-python

Tag scanned

v1.64.1

Compared with

v1.64.0 (0 signals introduced since)

Files

359 scanned, 75 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 7 info

Scan time

9.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 10:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution .azure-pipelines/publish-docker.yml:117:21

   [embedded bash] command name is a variable (`$ACR_CACHE_PREFIX`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   "docker run --rm --privileged ${ACR_CACHE_PREFIX}tonistiigi/binfmt --install arm64"

   likely benign LLM, confidence 0.70 Azure pipeline step that runs the tonistiigi/binfmt image privileged to register arm64 emulation, with the image prefix taken from a variable.

   Reasoning

   The command prefix comes from a pipeline variable, ACR_CACHE_PREFIX, which is typically a container registry mirror path. Running a privileged binfmt installer via docker is a common multi-arch CI setup. The variable-driven command name is a mild supply-chain concern, but the snippet alone does not show malicious intent.

2. info critical → info by review path-command-shadow .claude/skills/playwright-release/SKILL.md:88:49

   [embedded bash] redirect writes to `login` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)

   git -C "$PW_SRC_DIR" push <fork-remote> release-notes-1.xx-python
   gh pr create --repo microsoft/playwright --head <login>:release-notes-1.xx-python \
     --title "docs: release notes for v1.xx Python" \
     --body "- Add \`Version 1.xx\` to the Python release notes, translated from the Node.js notes"

   dismissed LLM, confidence 0.85 Markdown release-skill example showing a gh pr create command whose head is the placeholder <login>:branch.

   Reasoning

   The flagged token is a documentation placeholder, <login>, used as a GitHub username in a gh pr create example. It is not a real shell redirect or a PATH-shadowing filename. The finding is a markdown template artifact.

3. info warn → info by review frame-introspection playwright/_impl/_connection.py:682:13

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

   def _capture_stack_trace() -> ParsedStackTrace:
       frame = inspect.currentframe()
       # Skip this helper and the caller that only captures the stack.
       frame = frame.f_back.f_back if frame and frame.f_back else None

   likely benign LLM, confidence 0.95 Stack-trace capture helper that walks frames with inspect.currentframe to skip internal frames.

   Reasoning

   Playwright uses frame introspection to capture user call-site stack traces for error reporting. Skipping its own helper frames is a standard, legitimate debugging technique.

4. info warn → info by review frame-introspection playwright/_impl/_path_utils.py:23:29

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

       """Returns the callee (`__file__`) directory name"""
       frame = cast(FrameType, inspect.currentframe()).f_back
       module = inspect.getmodule(frame)
       assert module

   likely benign LLM, confidence 0.93 Helper that uses the caller frame's module to compute the directory of the calling file.

   Reasoning

   The code reads the caller's frame to find its module and derive the directory, which is the usual way to resolve a file's location from a helper. The pattern is benign.

5. info warn → info by review dynamic-import scripts/codegen/generate_api.js:120:22

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     fail('Set PW_SRC_DIR to a microsoft/playwright checkout at the release branch in DRIVER_VERSION.');
   const { parseApi } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'api_parser'));
   const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));

   likely benign LLM, confidence 0.85 Codegen script requiring doclint api_parser from a Playwright source checkout located via PW_SRC_DIR.

   Reasoning

   This is a maintainer codegen script. It requires modules from a microsoft/playwright checkout whose location comes from the PW_SRC_DIR environment variable, with a fail message if unset. The non-literal require is an explicit, developer-controlled path, not hidden execution.

6. info warn → info by review dynamic-import scripts/codegen/generate_api.js:121:33

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

   const { parseApi } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'api_parser'));
   const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));
   const md = require(path.join(PW_SRC_DIR, 'utils', 'markdown'));

   likely benign LLM, confidence 0.85 Requires doclint documentation module from the Playwright source checkout via path.join.

   Reasoning

   Same codegen script. The require paths are built with path.join from the developer-configured PW_SRC_DIR root and point at known doclint modules. This is a legitimate build-time import.

7. info warn → info by review dynamic-import scripts/codegen/generate_api.js:122:12

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

   const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));
   const md = require(path.join(PW_SRC_DIR, 'utils', 'markdown'));
   
   const BASE_CLASS = isAsync ? 'AsyncBase' : 'SyncBase';

   likely benign LLM, confidence 0.85 Requires the markdown utility module from the Playwright source checkout via path.join.

   Reasoning

   Same codegen script, requiring the markdown utility from the configured Playwright source tree. The dynamic specifier is a path under a developer-set root, consistent with normal tooling.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
git clone https://github.com/microsoft/playwright-python playwright-python && cd playwright-python
git checkout v1.64.1
disclude scan --untrusted --severity info --diff v1.64.0 .