Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
[embedded javascript] 19 of 37 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
-
file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
dc = zlib.decompressobj()
likely benign
LLM, confidence 0.93
Bounded zlib decompression of wire-protocol message data in the MongoDB driver.
Reasoning
zlib.decompressobj with a comment about bounding output size is standard decompression handling in the pymongo driver for wire-protocol compression, not a hidden payload.
-
file imports decoder module(s) base64 and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
async with eval(the_repr) as client_two:
self.assertEqual(client_two, client)
likely benign
LLM, confidence 0.95
Test evaluating a client repr string to verify round-tripping.
Reasoning
eval of repr(client) round-trip in a test checking object repr; base64 import is incidental. No malicious multi-stage shape in context.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
async with eval(the_repr) as client_two:
self.assertEqual(client_two, client)
likely benign
LLM, confidence 0.94
Test eval of a repr string for round-trip verification.
Reasoning
eval on repr(obj)-derived text in a driver test is a known idiom for repr round-trip checks; the input is not attacker-controlled.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
async with eval(the_repr) as client_two:
self.assertEqual(client_two, client)
likely benign
LLM, confidence 0.94
Test eval of a repr string in client repr check.
Reasoning
Same repr round-trip eval pattern in a test; benign test scaffolding.
-
concatenated bytes literal contains 336 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
data = (
b"a\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83"
b"\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83"
b"\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83"
likely benign
LLM, confidence 0.95
Test fixture bytes literal encoding UTF-8 snowman characters.
Reasoning
Bytes literal with UTF-8 snowman encodings is test data for BSON/string encoding; not an obfuscated payload.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
def assertRepr(self, obj):
new_obj = eval(repr(obj))
self.assertEqual(type(new_obj), type(obj))
self.assertEqual(repr(new_obj), repr(obj))
likely benign
LLM, confidence 0.94
Test helper evaluating repr of an object to check round-tripping.
Reasoning
eval(repr(obj)) in assertRepr helper verifying repr round-trip for test objects; a standard test idiom.
-
base64-like blob (112 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
return await self._test_explicit(
"AQGVERPgAAAAAAAAAAAAAAAC5DbBSwPwfSlBrDtRuglvNvCXD1KzDuCKY2P+4bRFtHDjpTOE2XuytPAUaAbXf1orsPq59PVZmsbTZbt2CB8qaQ=="
)
likely benign
LLM, confidence 0.94
Encrypted BSON binary test vector passed to explicit-encryption test.
Reasoning
Base64 string is a CSFLE/queryable encryption test vector in a binary subtype-6 format, consistent with encryption test fixtures.
-
base64-like blob (112 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
"$binary": {
"base64": "AQGVERPgAAAAAAAAAAAAAAAC5DbBSwPwfSlBrDtRuglvNvCXD1KzDuCKY2P+4bRFtHDjpTOE2XuytPAUaAbXf1orsPq59PVZmsbTZbt2CB8qaQ==",
"subType": "06"}
}}"""
likely benign
LLM, confidence 0.94
Extended JSON binary test vector for client-side encryption tests.
Reasoning
Same base64 BSON binary (subtype 06) test vector embedded in extended JSON for encryption tests.
-
base64-like blob (112 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
return await self._test_explicit(
"ARgj/gAAAAAAAAAAAAAAAAACwFd+Y5Ojw45GUXNvbcIpN9YkRdoHDHkR4kssdn0tIMKlDQOLFkWFY9X07IRlXsxPD8DcTiKnl6XINK28vhcGlg=="
)
likely benign
LLM, confidence 0.94
Encrypted BSON binary test vector for explicit encryption test.
Reasoning
Another encryption test vector in the fixed-format binary subtype-6 layout used in driver test suites.
-
base64-like blob (112 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
"$binary": {
"base64": "ARgj/gAAAAAAAAAAAAAAAAACwFd+Y5Ojw45GUXNvbcIpN9YkRdoHDHkR4kssdn0tIMKlDQOLFkWFY9X07IRlXsxPD8DcTiKnl6XINK28vhcGlg==",
"subType": "06"}
}}"""
likely benign
LLM, confidence 0.94
Extended JSON binary test vector for client-side encryption tests.
Reasoning
Extended JSON duplicate of the same encryption test vector; benign test data.
-
concatenated bytes literal contains 41 `\xNN` escapes (85% of content) — binary payload shape (ast pass, confidence 0.85)
bson_string = (
b"D\x00\x00\x00\x04embedded\x005\x00\x00\x00\x030\x00-\x00\x00\x00"
b"\tdate\x00\x8a\xd6\xb9\xbaM\x01\x00\x00\x05_id\x00\x10\x00\x00"
b"\x00\x03eI_\x97\x8f\xabo\x02\xff`L\x87\xad\x85\xbf\x9f\x00\x00"
likely benign
LLM, confidence 0.93
Raw BSON byte fixture for embedded document parsing test.
Reasoning
Bytes literal is a hand-written BSON document with embedded date and ObjectId fields, typical for raw BSON parsing tests.
-
base64-like blob (71 bytes, compression ratio 1.15) (raw pass, confidence 0.60)
LOCAL_MASTER_KEY = base64.b64decode(
b"Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ"
b"5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk"
)
likely benign
LLM, confidence 0.88
Test-only local master key base64-encoded in a helper module.
Reasoning
Base64 string decodes to a local master key used for encryption tests; it is a readable ASCII key-like string in a test helper, a fixture rather than a hidden payload. Slight doubt since it is a key-like literal.
-
command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)
PYTHON=/opt/python/cp310-cp310/bin/python
$PYTHON -m pip install -v -e .
-
concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
decode_all(
b"\x1b\x00\x00\x00\x0e\x74\x65\x73\x74"
b"\x00\x0c\x00\x00\x00\x68\x65\x6c\x6c"
b"\x6f\x20\x77\x6f\x72\x6c\x64\x00\x00"
likely benign
LLM, confidence 0.94
BSON byte fixture for decode_all test.
Reasoning
Bytes literal encoding a BSON document with the ASCII string 'hello world', consistent with BSON decode tests.
-
concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
decode_iter(
b"\x1b\x00\x00\x00\x0e\x74\x65\x73\x74"
b"\x00\x0c\x00\x00\x00\x68\x65\x6c\x6c"
b"\x6f\x20\x77\x6f\x72\x6c\x64\x00\x00"
likely benign
LLM, confidence 0.95
Concatenated BSON byte fixture used in a decoding test.
Reasoning
This is the pymongo BSON test suite; the bytes literals are hand-written BSON wire-format fixtures for decode_iter, a legitimate test-vector pattern.
-
concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
BytesIO(
b"\x1b\x00\x00\x00\x0e\x74\x65\x73\x74"
b"\x00\x0c\x00\x00\x00\x68\x65\x6c\x6c"
b"\x6f\x20\x77\x6f\x72\x6c\x64\x00\x00"
likely benign
LLM, confidence 0.95
BSON wire-format bytes fixture for a BytesIO decode test.
Reasoning
Same BSON binary test fixture in a BytesIO-based decode test in a bson library test file; expected binary shape.
-
concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
(
b"\x1a\x00\x00\x00\x0e\x74\x65\x73\x74"
b"\x00\x0c\x00\x00\x00\x68\x65\x6c\x6c"
b"\x6f\x20\x77\x6f\x72\x6c\x64\x00\x00"
likely benign
LLM, confidence 0.95
BSON byte-string test vector.
Reasoning
BSON encoded document fixture in a bson library test suite; the escapes encode a known document.
-
concatenated bytes literal contains 32 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
(
b"\x1b\x00\x00\x00\x0e\x74\x65\x73\x74"
b"\x00\x0c\x00\x00\x00\x68\x65\x6c\x6c"
b"\x6f\x20\x77\x6f\x72\x6c\x64\x00\x00"
likely benign
LLM, confidence 0.95
BSON byte-string test vector.
Reasoning
BSON encoded document test vector in the bson test suite, matching the surrounding fixtures.
-
concatenated bytes literal contains 33 `\xNN` escapes (90% of content) — binary payload shape (ast pass, confidence 0.85)
encode({"ref": DBRef("coll", a)}),
b"\x2f\x00\x00\x00\x03ref\x00\x25\x00\x00\x00\x02"
b"$ref\x00\x05\x00\x00\x00coll\x00\x07$id\x00\x00"
b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x00"
likely benign
LLM, confidence 0.93
BSON DBRef encoding fixture in a test.
Reasoning
Hand-built BSON DBRef encoding bytes in a serialization test of a BSON library; structured wire-format data, not a payload.
-
file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
def assertRepr(self, obj):
new_obj = eval(repr(obj))
self.assertEqual(type(new_obj), type(obj))
self.assertEqual(repr(new_obj), repr(obj))
likely benign
LLM, confidence 0.90
Test helper that evals repr(obj) to check round-tripping.
Reasoning
assertRepr round-trips an object's repr through eval in a serialization test; the input is the test's own object, so no untrusted input reaches eval.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
def assertRepr(self, obj):
new_obj = eval(repr(obj))
self.assertEqual(type(new_obj), type(obj))
self.assertEqual(repr(new_obj), repr(obj))
likely benign
LLM, confidence 0.90
eval of repr output in a repr round-trip test.
Reasoning
Same repr round-trip eval in a test helper; the argument is generated from a locally constructed object.
-
concatenated bytes literal contains 33 `\xNN` escapes (92% of content) — binary payload shape (ast pass, confidence 0.85)
self.assertEqual(
b"\x2c\x00\x00\x00"
b"\x02_id\x00\x02\x00\x00\x00b\x00"
b"\x03b\x00"
likely benign
LLM, confidence 0.93
BSON bytes fixture in an assertion.
Reasoning
BSON wire-format fixture for an assertEqual in a bson decoding test.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
self.assertEqual(
repr(eval(repr(tz))), "FixedOffset(datetime.timedelta(seconds=2520), 'forty-two')"
)
likely benign
LLM, confidence 0.92
Repr round-trip eval in a timezone serialization test.
Reasoning
eval(repr(tz)) round-trip check for a tzinfo object in a bson test; not fed external input.
-
concatenated bytes literal contains 36 `\xNN` escapes (62% of content) — binary payload shape (ast pass, confidence 0.85)
pickled_with_3 = (
b"\x80\x04\x95q\x00\x00\x00\x00\x00\x00\x00\x8c\n"
b"bson.dbref\x94\x8c\x05DBRef\x94\x93\x94)\x81\x94}"
b"\x94(\x8c\x12_DBRef__collection\x94\x8c\x03foo\x94"
likely benign
LLM, confidence 0.90
Pickled DBRef byte fixture in a compatibility test.
Reasoning
Pickle protocol bytes fixture for a DBRef pickle compatibility test in a bson library; the content is a legitimate serialized object used for testing.
-
concatenated bytes literal contains 43 `\xNN` escapes (63% of content) — binary payload shape (ast pass, confidence 0.85)
pickled_with_3 = (
b"\x80\x04\x95\x81\x00\x00\x00\x00\x00\x00\x00\x8c"
b"\nbson.dbref\x94\x8c\x05DBRef\x94\x93\x94)\x81\x94}"
b"\x94(\x8c\x12_DBRef__collection\x94\x8c\x03foo\x94"
likely benign
LLM, confidence 0.90
Pickled DBRef byte fixture in a compatibility test.
Reasoning
Pickle protocol test fixture for DBRef in the bson test suite, a standard pattern for checking unpickling compatibility.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
obj = DatetimeMS(value)
self.assertEqual(eval(repr(obj)), obj)
def test_datetime_ms_invalid_type(self):
likely benign
LLM, confidence 0.90
Repr round-trip eval in a DatetimeMS test.
Reasoning
Round-trip eval of repr(DatetimeMS) in a bson test; locally constructed object, not untrusted input.
-
file imports decoder module(s) base64 and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
with eval(the_repr) as client_two:
self.assertEqual(client_two, client)
likely benign
LLM, confidence 0.88
eval of a client repr in a round-trip test.
Reasoning
In the pymongo client test, eval(the_repr) reconstructs a client from its own repr to test repr round-tripping; the input is generated locally, not external.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
with eval(the_repr) as client_two:
self.assertEqual(client_two, client)
likely benign
LLM, confidence 0.88
eval of a client repr in a round-trip test.
Reasoning
Same client repr round-trip eval in a test of pymongo; the argument comes from the test's own client object.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
with eval(the_repr) as client_two:
self.assertEqual(client_two, client)
likely benign
LLM, confidence 0.93
Test evaluates the repr of a MongoClient to verify round-tripping.
Reasoning
eval of a repr string in a PyMongo test suite is a round-trip check of a client's repr; the test file is a test, not shipped runtime code. Not malicious, though eval is generally a risk pattern.
-
concatenated bytes literal contains 336 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)
data = (
b"a\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83"
b"\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83"
b"\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83\xe2\x98\x83"
likely benign
LLM, confidence 0.95
Test data containing UTF-8 encoded snowman characters as bytes.
Reasoning
Bytes literal with UTF-8 snowman encodings is a test fixture for unicode handling in BSON/collections; typical test data, not a dropper payload.
-
file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
compressed = ctx.compress(data)
self.assertEqual(zlib.decompress(compressed), data)
likely benign
LLM, confidence 0.93
Test asserts zlib round-trip of locally compressed data.
Reasoning
zlib.decompress round-trip assertion on data the test itself compressed; a standard compression test, not an embedded payload executed at runtime.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
def assertRepr(self, obj):
new_obj = eval(repr(obj))
self.assertEqual(type(new_obj), type(obj))
self.assertEqual(repr(new_obj), repr(obj))
likely benign
LLM, confidence 0.93
Test helper evals repr of an object to check round-trip.
Reasoning
Same repr/eval round-trip helper used in PyMongo tests to check object repr fidelity; eval input is repr of test objects, not external input.
-
base64-like blob (112 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
return self._test_explicit(
"AQGVERPgAAAAAAAAAAAAAAAC5DbBSwPwfSlBrDtRuglvNvCXD1KzDuCKY2P+4bRFtHDjpTOE2XuytPAUaAbXf1orsPq59PVZmsbTZbt2CB8qaQ=="
)
likely benign
LLM, confidence 0.90
Base64 encoded binary test vector for client-side encryption.
Reasoning
Base64 blob with a BSON binary subtype 06 (queryable encryption ciphertext) in a client-side encryption test fixture; expected test vector data.
-
base64-like blob (112 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
"$binary": {
"base64": "AQGVERPgAAAAAAAAAAAAAAAC5DbBSwPwfSlBrDtRuglvNvCXD1KzDuCKY2P+4bRFtHDjpTOE2XuytPAUaAbXf1orsPq59PVZmsbTZbt2CB8qaQ==",
"subType": "06"}
}}"""
likely benign
LLM, confidence 0.90
Extended JSON binary test vector for encryption tests.
Reasoning
Same base64 BSON binary test vector embedded in extended JSON for encryption tests; consistent with legitimate fixture data.
-
base64-like blob (112 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
return self._test_explicit(
"ARgj/gAAAAAAAAAAAAAAAAACwFd+Y5Ojw45GUXNvbcIpN9YkRdoHDHkR4kssdn0tIMKlDQOLFkWFY9X07IRlXsxPD8DcTiKnl6XINK28vhcGlg=="
)
likely benign
LLM, confidence 0.90
Base64 encoded binary test vector for client-side encryption.
Reasoning
Another base64 encryption test vector with subtype 06 in a test file; legitimate fixture.
-
base64-like blob (112 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
"$binary": {
"base64": "ARgj/gAAAAAAAAAAAAAAAAACwFd+Y5Ojw45GUXNvbcIpN9YkRdoHDHkR4kssdn0tIMKlDQOLFkWFY9X07IRlXsxPD8DcTiKnl6XINK28vhcGlg==",
"subType": "06"}
}}"""
likely benign
LLM, confidence 0.90
Extended JSON binary test vector for encryption tests.
Reasoning
Extended JSON wrapper of a base64 BSON binary test vector; legitimate test fixture.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
def assertRepr(self, obj):
new_obj = eval(repr(obj))
self.assertEqual(type(new_obj), type(obj))
self.assertEqual(repr(new_obj), repr(obj))
likely benign
LLM, confidence 0.93
Test helper evals repr of an object to verify round-trip.
Reasoning
Repr/eval round-trip helper in a PyMongo operations test; same benign test pattern.
-
concatenated bytes literal contains 41 `\xNN` escapes (85% of content) — binary payload shape (ast pass, confidence 0.85)
bson_string = (
b"D\x00\x00\x00\x04embedded\x005\x00\x00\x00\x030\x00-\x00\x00\x00"
b"\tdate\x00\x8a\xd6\xb9\xbaM\x01\x00\x00\x05_id\x00\x10\x00\x00"
b"\x00\x03eI_\x97\x8f\xabo\x02\xff`L\x87\xad\x85\xbf\x9f\x00\x00"
likely benign
LLM, confidence 0.93
Test fixture of raw BSON bytes.
Reasoning
Bytes literal encoding a BSON document is a raw BSON test fixture for the raw_bson module; expected binary test data.
-
concatenated bytes literal contains 37 `\xNN` escapes (73% of content) — binary payload shape (ast pass, confidence 0.85)
TEST_RAW_BSON = (
b"Z\x00\x00\x00\x07_id\x00Um\xf6\x8bn2\xab!\xa9^\x07\x85\x02name\x00\t"
b"\x00\x00\x00Sherlock\x00\x04addresses\x00&\x00\x00\x00\x030\x00\x1e"
b"\x00\x00\x00\x02street\x00\r\x00\x00\x00Baker Street\x00\x00\x00\x00"
likely benign
LLM, confidence 0.93
Shared raw BSON test fixture bytes.
Reasoning
Shared BSON byte fixture encoding a sample document (Sherlock Baker Street) for raw BSON tests; legitimate test data.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
def assertRepr(self, obj):
new_obj = eval(repr(obj))
self.assertEqual(type(new_obj), type(obj))
self.assertEqual(repr(new_obj), repr(obj))
likely benign
LLM, confidence 0.93
Test helper evals repr of an object to verify round-trip.
Reasoning
Repr/eval round-trip helper in a write concern test; benign test utility pattern.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io