disclude.iopygments 2.21.0
- Source
- https://github.com/pygments/pygments
- Artifact scanned
pygments-2.21.0-py3-none-any.whl- Compared with
pygments-2.20.0-py3-none-any.whl(0 signals introduced since)- Files
- 344 scanned, 5 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 37 info
- Scan time
- 15.1 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 16 of 16 warn and critical signals; 16 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-22 23:33
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
"""Load a formatter (and all others in the module too).""" = =likely benign Dynamic __import__ of a built-in formatter submodule by name.Reasoning
This is Pygments' standard plugin loader. module_name is an internal module path from a fixed mapping of built-in formatters, not attacker input, and the code only reads __all__ and getattr's classes from it. Dynamic import is the expected mechanism here.
-
# Retrieve the class `formattername` from that namespacelikely benign exec of a user-supplied formatter plugin file into a namespace.Reasoning
This is the load_formatter_from_file feature, which execs a user-specified Python file to get a custom formatter class. Executing a file the user explicitly names is the documented purpose. It is not a hidden payload and the file is not fetched from a remote source.
-
"""Load a lexer (and all others in the module too).""" = =likely benign Dynamic __import__ of a built-in lexer module by name.Reasoning
Standard Pygments lexer loader that imports a built-in lexer module by its internal name and reads its __all__. The name comes from a fixed internal mapping, so this is the expected pattern.
-
# Retrieve the class `lexername` from that namespacelikely benign exec of a user-supplied lexer plugin file into a namespace.Reasoning
This is the load_lexer_from_file feature, which execs a user-specified lexer plugin file. Running a file the caller explicitly points to is the intended behavior of this API, not hidden execution.
-
""" pygments.lexers._luau_builtins ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -
=likely benign Reads the module's own source as part of a data-regeneration helper.Reasoning
This is a generated builtins data module that reads its own source to regenerate or inspect its keyword tables. Reading __file__ in a maintenance or regeneration helper does not extract hidden payloads. It is not executed on import.
-
likely benign Rewrites the module's own source with regenerated builtins data.
Reasoning
The same generated module writes its own file back with regenerated keyword data. This matches a code-generation script that rewrites a data table. There is no network, exec, or hidden payload involved.
-
=likely benign Reads its own source in a generated-builtins maintenance path.Reasoning
This is a generated Scilab builtins module that reads its own source during regeneration. The read is for maintenance tooling and does not run any extracted content.
-
likely benign Rewrites its own file with an autogenerated header during generation.
Reasoning
The snippet writes a header and an autogenerated marker back to the same file, consistent with a code generator rewriting its output. Nothing is executed and no payload is decoded.
-
# following IBM APL2 standard , # # Labels -
# following IBM APL2 standard , # # Labels -
# following IBM APL2 standard # (r'[A-Za-zΔ∆⍙][A-Za-zΔ∆⍙_¯0-9]*:', Name.Label), # # Variables -
# following IBM APL2 standard # (r'[A-Za-zΔ∆⍙][A-Za-zΔ∆⍙_¯0-9]*:', Name.Label), # # Variables -
# following IBM APL2 standard (with a leading _ ok for GNU APL and Dyalog) , # # Numbers -
# following IBM APL2 standard (with a leading _ ok for GNU APL and Dyalog) , # # Numbers -
= = + r + + r -
= = + r + + r -
) = + r + + r -
) = + r + + r -
= = + r + + r -
= = + r + + r -
) = + r + + r -
) = + r + + r -
= == :likely benign Optional gzip/bz2 decompression of token-stream input in the raw-token lexer.Reasoning
This is the Raw/Tokens lexer's optional decompression of its own compressed token-stream input when the compress option is set, a test and serialization feature. The bytes come from the caller's own input, not from a hidden embedded payload that is run.
-
| | | | | |, | | | | | | | | | | | | | | | | | | | | | | -
, | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -
| | | | | | | | | | | | | | | | | | | | | | | | | | | | \'all |When |Wenn |WEN |Và |Ve |Und |Un |Thì |T -
| | | | | | | | | | | | | | | | | | | | | | | | \'all |When |Wenn |WEN |Và |Ve |Und |Un |Thì |Then y\'all |Then |Tapi |Tak |Tada |Tad |Så |Stel |Soi -
= = =likely benign Dynamic import of a lexer class named in a Sphinx documentation directive.Reasoning
This is the Sphinx extension's lookup of a lexer class by a module name taken from the project's own documentation directive. It is a developer-configured import in a documentation build step, not attacker-controlled input at runtime.
-
= = =likely benign Dynamic import of a documented lexer class during Sphinx builds.Reasoning
This is the same Sphinx extension lookup as the earlier finding, resolving a documented lexer class through __import__. It runs only during documentation builds on the developer's own config.
-
=likely benign Dynamic import of a built-in style module with ClassNotFound fallback.Reasoning
This is the standard style loader that imports a built-in style module by name. It raises ClassNotFound on ImportError, which is ordinary plugin-lookup behavior with an internal mapping.
-
= -
returnlikely benign Looks up Unicode range constants by name via globals() in a helper.Reasoning
combine() looks up Unicode category range constants by name in the module's globals, drawing from a fixed set of internal string constants. This is a common Python idiom for a data-table helper and has no hidden behavior.
-
returnlikely benign Second globals() constant lookup in the Unicode category combiner.Reasoning
The same globals() lookup of internal Unicode category constants, in the helper that removes categories before combining. It is a data-construction idiom with no external input.
-
=likely benign Reads its own source as part of a Unicode table generator.Reasoning
This module reads its own source to build Unicode tables during generation. It is a generator or maintenance helper for a static data module, and nothing from the read is executed.
-
likely benign A pygments module writes a generated header to its own file path, consistent with a self-regenerating unicode data module.
Reasoning
The snippet opens __file__ in write mode and writes a header, which is a code generator regenerating the module's own unicode tables (pygments' unistring.py is produced by a script that rewrites itself). It does not read its own source for payload extraction, and it contains no exec, decoding, network or process calls. The ast rule fired on the open(__file__) call, which is a false positive here.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|