disclude.iopymongo 4.19.0
- Source
- https://github.com/mongodb/mongo-python-driver
- Artifact scanned
pymongo-4.19.0.tar.gz- Compared with
pymongo-4.18.3.tar.gz(11 signals introduced since)- Files
- 594 scanned, 1530 skipped (binary, oversized, or unrecognised)
- Signals
- 2 critical · 1 warn · 68 info
- Scan time
- 48.4 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 65 of 67 warn and critical signals; 64 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 11:18
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
[ || PY=python3 [ \ || { ; ; } -
|| { ; ; } -
inconclusive A hidden Markdown comment states that PRs must be written and understood by humans.
Reasoning
The comment is a policy statement about human authorship, placed in an HTML comment that does not render. It may be aimed at AI-assisted submissions, which fits the hidden-instruction pattern, but the text is a harmless contributor policy and does not ask an AI to do anything harmful.
-
# No-op on Evergreen (just.sh already ran this); needed for direct/local runs (PYTHON-6135). # Start the test runner.likely benign Sources a repo-local script to set up uv and Python.Reasoning
Sources setup-uv-python.sh from the repo's scripts directory; the comment explains its purpose for local runs.
-
info
warn→ info by reviewdynamic-import.evergreen/scripts/install-dependencies.sh:73:5new in this releaseif [; then ||likely benign Sources an ensure-uv helper from the drivers-tools checkout.Reasoning
Sources ensure-uv.sh from DRIVERS_TOOLS, an external drivers-tools checkout provided by the CI environment. The path is variable, so trust depends on that checkout; it is a legitimate helper pattern.
-
info
warn→ info by reviewdynamic-import.evergreen/scripts/install-dependencies.sh:84:5new in this releaseif [; then filikely benign Conditionally sources a local env.sh in the install script.Reasoning
Conditionally sources local env.sh from HERE; ordinary repo-local include.
-
info
critical→ info by reviewdynamic-execution.evergreen/scripts/resync-all-specs.sh:40:8new in this release[ || PY=python3 [ \ || { ; ; }likely benign Runs the resync Python script using a version-checked interpreter.Reasoning
Interpreter selection via $PY with a version check, then runs a repo-local Python script to resync specs; no obfuscation or encoded payload.
-
info
critical→ info by reviewdynamic-execution.evergreen/scripts/resync-all-specs.sh:42:3new in this release|| { ; ; } if ; then # changes were made -> call scrypt to create PR for uslikely benign Executes the repository's spec resync Python script.Reasoning
Runs the repo-local resync-all-specs.py with the chosen interpreter and a PR description file; standard maintenance automation.
-
info
warn→ info by reviewdynamic-import.evergreen/scripts/setup-dev-env.sh:89:1new in this release# Handle the value for UV_PYTHON. # Only run the next part if not running on CI.likely benign Sources a sibling setup-uv-python.sh helper.Reasoning
Sourcing setup-uv-python.sh from the script directory is the expected way to split out setup logic in the repository.
-
info
warn→ info by reviewdynamic-execution.evergreen/scripts/setup-uv-python.sh:27:10new in this releaseif [ || [; then if ! ; thenlikely benign Runs a Python interpreter stored in $_py to test whether an existing .venv is functional.Reasoning
The variable $_py is an interpreter path that the script checks for existence and then runs with a sanity import to detect a broken .venv. That is local environment repair, not a dropper. The variable is not set in this file, so some doubt remains about its origin.
-
info
warn→ info by reviewdynamic-import.evergreen/scripts/setup-uv-python.sh:38:3new in this releaseif [; thenlikely benign Conditionally sources env.sh from the script's directory.Reasoning
Sourcing env.sh from $HERE with an existence check is ordinary build-script configuration loading.
-
info
warn→ info by reviewdynamic-import.evergreen/scripts/setup-uv-python.sh:43:3new in this releaseif [; thenlikely benign Conditionally sources test-env.sh from the script's directory.Reasoning
Conditionally sourcing test-env.sh from the script's directory is routine setup code.
-
elselikely benign Sources a repository-local environment setup script.Reasoning
Sourcing env.sh via $SCRIPT_DIR is a standard CI helper include from the repository's own scripts directory; no remote or encoded input.
-
elselikely benign Sources a repository-local test environment script.Reasoning
Sources a repo-local test-env.sh from SCRIPT_DIR, typical CI configuration loading.
-
likely benign Sources a sibling env.sh configuration script.
Reasoning
Sources env.sh relative to the script's own directory, standard repo-local CI helper pattern.
-
# Set up the virtual env.likely benign Sources a sibling setup script to create a dev environment.Reasoning
Sources setup-dev-env.sh from the script's directory to set up a virtualenv; ordinary build tooling.
-
likely benign Conditionally sources a local env.sh file during cleanup.
Reasoning
Conditionally sources env.sh from the script directory in a cleanup script; ordinary repo-local include.
-
likely benign Sources a local env.sh to configure the environment.
Reasoning
Reads env.sh from SCRIPT_DIR, a repo-local configuration file; standard for CI scripts.
-
if [; thenlikely benign Sources a local env.sh before installing dependencies.Reasoning
Conditionally sources env.sh from HERE, repo-local; typical CI pattern.
-
|| ||likely benign Sources get-distro.sh from a variable DRIVERS_TOOLS path in a CI script.Reasoning
Sourcing a helper from DRIVERS_TOOLS, an environment-configured CI tools checkout, is ordinary Evergreen build plumbing. No encoding or obfuscation is involved.
-
likely benign Sources a sibling env.sh file located via $HERE.
Reasoning
Sourcing an env.sh that sits beside the script, via a path derived from the script's own directory, is a standard pattern in CI helper scripts.
-
if [; thenlikely benign Conditionally sources env.sh from the script's directory.Reasoning
Conditionally sourcing an env.sh next to the script is a common dev-environment setup idiom and is guarded by an existence check.
-
if [; thenlikely benign Conditionally sources test-env.sh from the script's directory.Reasoning
Conditionally sourcing test-env.sh from the script's directory is ordinary setup logic with an existence guard.
-
if [; thenlikely benign Conditionally sources env.sh again later in the same setup script.Reasoning
This repeats the env.sh sourcing pattern found earlier in the same script, with an existence check. Nothing suggests malice.
-
# Add 'server' and 'hostname_not_in_cert' as a hostnames | | -
| | -
if [; thenlikely benign Conditionally sources env.sh from the script's directory.Reasoning
Conditionally sourcing env.sh from SCRIPT_DIR is routine test setup with an existence guard.
-
likely benign Sources env.sh from $HERE to load configuration before stopping a server.
Reasoning
Sourcing env.sh from the script directory to load settings for stopping the server is ordinary CI script behavior.
-
elselikely benign Conditionally sources env.sh from SCRIPT_DIR during test teardown.Reasoning
Sourcing env.sh from SCRIPT_DIR in a conditional branch is standard teardown configuration loading.
-
elselikely benign Conditionally sources test-env.sh from SCRIPT_DIR during teardown.Reasoning
Sourcing test-env.sh from SCRIPT_DIR in a conditional branch is standard test-input loading.
-
= # Bound the decompressed output during decompression to avoid # allocating a huge buffer before the size check runs.likely benign Uses zlib.decompressobj with bounded output to decompress wire-protocol compression.Reasoning
zlib decompressobj with a bounded output size is standard, defensive handling of compressed MongoDB wire-protocol messages. The comment explicitly explains the size bounding, and there is no embedded payload.
-
likely benign Test code uses eval on a client repr inside an async context manager.
Reasoning
The file imports base64 and calls eval on a repr string in a test. The eval is odd and unsafe-looking, but it is confined to a test fixture in a MongoDB driver's async test suite, with no sign of a decode-then-execute payload.
-
likely benign Test evaluates a client's repr to check round-trip construction.
Reasoning
eval of repr(client) in a test round-trips a MongoClient repr to verify it reconstructs an equal client; the input is the object's own repr, not untrusted data. Common test idiom.
-
likely benign Test evaluates a client's repr to verify reconstruction equality.
Reasoning
Same repr round-trip eval pattern as the other finding in this test file; benign test code.
-
=likely benign Test fixture bytes encoding repeated UTF-8 snowman characters.Reasoning
Concatenated bytes literal of UTF-8 encoded snowman characters used as test data for a PyMongo/BSON test; this is a fixture of expected encoded bytes, not a hidden payload.
-
=likely benign Test helper evaluates an object's repr to check round-trip fidelity.Reasoning
eval(repr(obj)) in an assertRepr test helper round-trips an object's repr to check type and repr equality. Input is the test's own objects; benign.
-
return awaitlikely benign Base64 ciphertext test vector for client-side encryption tests.Reasoning
Base64 string is a BSON Queryable Encryption test vector (binary subtype 6 ciphertext) passed to a test helper; expected test data in a driver test suite.
-
: }}likely benign Base64 binary test vector within extended JSON for encryption tests.Reasoning
Same base64 encrypted-BSON test vector embedded in extended JSON for an encryption test; legitimate fixture.
-
return awaitlikely benign Base64 ciphertext test vector for explicit encryption tests.Reasoning
Another base64 encryption test vector of the same kind, used in explicit encryption tests; benign fixture.
-
: }}likely benign Base64 binary test vector in extended JSON for encryption tests.Reasoning
Base64 binary test vector within extended JSON for encryption tests, matching the pattern of other fixtures in the file; benign.
-
=likely benign Raw BSON document bytes used as test input.Reasoning
Bytes literal is a hand-written BSON document used to test raw BSON decoding; expected for a BSON library's test suite.
-
=likely benign Test-only base64 master key for encryption test helpers.Reasoning
Base64 string decodes to a test master key for client-side encryption tests; a fixture key in a test helper. Not a real secret, and the decoded content is only used locally in tests.
-
PYTHON=/opt/python/cp310-cp310/bin/python -
likely benign BSON-encoded test document bytes for decode_all.
Reasoning
Bytes literal encodes a small BSON document 'hello world' for decode_all tests; standard BSON test fixture.
-
likely benign BSON test fixture bytes for decode_iter.
Reasoning
Same BSON 'hello world' fixture passed to decode_iter in a test; benign.
-
likely benign BSON test fixture bytes wrapped in BytesIO.
Reasoning
Same BSON test fixture wrapped in BytesIO for decoding tests; benign.
-
likely benign Concatenated BSON byte-string test vector in the bson test suite.
Reasoning
The bytes literal is a hand-written BSON encoding of a small document with a 'test' key and 'hello world' value, the kind of fixture a BSON library's test suite uses to check its decoder. It is test data, not a payload.
-
likely benign Second BSON byte-vector fixture in the bson test suite.
Reasoning
Same structure as the neighbouring fixture, a BSON-encoded document used as expected input for a decode or encode assertion in a test. Nothing executes it.
-
, b b blikely benign BSON DBRef encoding fixture used as expected output in a test.Reasoning
A BSON-encoded DBRef document (collection 'coll', ObjectId bytes 01..0b) used as the expected encoding for a DBRef round-trip test. This is a standard test fixture.
-
=likely benign Test helper that checks an object's repr round-trips through eval.Reasoning
assertRepr evals repr(obj) of an object the test itself constructed to check that its repr round-trips. The input is locally produced, not external, and the pickle import is only incidental to the test module.
-
=likely benign eval of repr output in an assertion helper for round-trip testing.Reasoning
eval(repr(obj)) inside assertRepr is a deliberate repr round-trip check on a test-constructed object. The argument is the output of repr on trusted local data.
-
likely benign BSON byte-string fixture in an assertEqual in the bson test suite.
Reasoning
A BSON byte fixture (an _id field plus a short string, or similar) passed to assertEqual as expected bytes in a codec test. It is test data.
-
likely benign Round-trip eval of a timezone repr in a test assertion.
Reasoning
eval(repr(tz)) round-trips a locally constructed FixedOffset tzinfo object and compares the result to its expected repr string. This is a repr-stability test on local data.
-
=likely benign Pickled DBRef byte fixture for backward-compatibility testing.Reasoning
The bytes are a pickle protocol-4 stream for a bson.dbref.DBRef object, used as a fixture to verify that old pickles still unpickle correctly. Pickle fixtures are normal in serialization tests, and this one does not execute anything by itself.
-
=likely benign Second pickled DBRef fixture for compatibility testing.Reasoning
Another pickle protocol-4 fixture for bson.dbref.DBRef, used as test input for unpickling compatibility. It is test data.
-
=likely benign Repr round-trip eval for DatetimeMS in a test.Reasoning
eval(repr(obj)) on a DatetimeMS value the test just constructed, checking that the repr round-trips. The input is trusted and local.
-
likely benign Test evaluates a client repr to check round-tripping.
Reasoning
eval(the_repr) reconstructs a MongoClient from its own repr to check that the repr round-trips, and the result is used as a context manager. The repr is produced locally by the test, so no untrusted input reaches eval.
-
likely benign Dynamic eval of a client repr string inside a round-trip test.
Reasoning
Same eval(the_repr) round-trip of a locally generated client repr in a test. No external input.
-
likely benign Second round-trip eval of a client repr in a test.
Reasoning
Repeats the same eval(the_repr) round-trip pattern on a locally produced repr in another test. It is benign.
-
=likely benign UTF-8 encoded snowman character test data in a collection test.Reasoning
The bytes literal is a UTF-8 snowman (\xe2\x98\x83) repeated to build a Unicode test string, used to check encoding and size handling. It is an ordinary test fixture.
-
=dismissed Test round-trips data through zlib compress and decompress to verify the compression context.Reasoning
zlib.decompress on data the test itself just compressed with ctx.compress; a round-trip assertion in a compression test suite, not a runtime payload.
-
=dismissed Test helper evaluates repr of a test object to verify round-trip representation.Reasoning
eval(repr(obj)) in a test helper checks that a BSON/PyMongo object's repr round-trips; the input is the test's own object, not attacker data.
-
returndismissed Base64 test fixture for an encrypted BSON binary value.Reasoning
Base64 string is a Queryable Encryption/CSFLE test vector with a binary subtype header; expected for MongoDB encryption tests.
-
: }}dismissed Extended JSON binary fixture for encryption test vectors.Reasoning
Same base64 test vector embedded in extended JSON ($binary with subType 06) for encryption tests; legitimate fixture data.
-
returndismissed Base64 encryption test vector fixture.Reasoning
Another encryption test vector in base64 with a fixed structure typical of MongoDB client-side encryption fixtures.
-
: }}dismissed Extended JSON binary test fixture for encryption.Reasoning
Duplicate of the extended JSON $binary fixture pattern used in MongoDB encryption tests; benign test data.
-
=dismissed Test helper using eval on repr of a test object to check round-trip.Reasoning
Same assertRepr helper in the PyMongo test suite evaluating repr of test objects; no external input reaches eval.
-
=dismissed Raw BSON byte-string test vector.Reasoning
Hand-written BSON byte literal with \x escapes encoding a document for raw BSON tests; binary escapes are expected for BSON test vectors.
-
=dismissed Shared raw BSON byte fixture for tests.Reasoning
Shared raw BSON test fixture with recognizable BSON structure (field names, lengths); legitimate test data.
-
=dismissed Test helper evaluating repr of a test object for round-trip checking.Reasoning
Repeated assertRepr eval(repr(obj)) test helper in the test suite; the input is a locally constructed object.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&