pyparsing 3.3.3

Source: https://github.com/pyparsing/pyparsing
Tag scanned: 3.3.3
Compared with: 3.3.2 (0 signals introduced since)
Files: 185 scanned, 96 skipped (binary, oversized, or unrecognised)
Signals: 1 critical · 0 warn · 72 info
Scan time: 15.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 26 of 26 warn and critical signals; 25 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:24

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

critical dynamic-execution run_perf_all_tags.sh:96:5

`eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)
```
    # Using the Windows-style py launcher (rare on Ubuntu), invoke as: py -3.12 -m venv
    eval "$interp_cmd -m venv \"$VENV_DIR\"" || { echo "Failed to create venv for Python $pv, skipping..."; continue; }
  else
```
suspicious LLM, confidence 0.70 eval of a venv creation command in a performance benchmark script.
Reasoning
eval is used on a string built from $interp_cmd and $VENV_DIR; this is a benchmark script whose interpreter command comes from the script's own version list, but eval with unquoted expansion is an injection risk if VENV_DIR or interp_cmd is tainted. Likely a benign but poor-practice construct.
info ~~warn~~ → info by review unicode-homoglyph docs/HowToUsePyparsing.rst:1430:35

identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (raw pass, confidence 0.70)
```
    greek_word = pp.Word(ppu.Greek.alphas)
    greek_word[...].parse_string("Καλημέρα κόσμε")

The following language ranges are defined.
```
dismissed LLM, confidence 0.97 Greek word 'Καλημέρα' in a docs example of parsing Greek text.
Reasoning
Greek text in a documentation example demonstrating Greek word parsing for pyparsing; homoglyph flag is a false positive from the legitimate Greek word.
info ~~warn~~ → info by review unicode-mixed-script docs/HowToUsePyparsing.rst:1430:35

identifier `Καλημέρα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
    greek_word = pp.Word(ppu.Greek.alphas)
    greek_word[...].parse_string("Καλημέρα κόσμε")

The following language ranges are defined.
```
dismissed LLM, confidence 0.95 Greek string literal in docs flagged for mixed scripts.
Reasoning
The 'identifier' is a string literal of Greek prose in documentation, not an identifier; mixed-script flag is spurious since the snippet only contains Greek text.
info ~~warn~~ → info by review unicode-homoglyph docs/HowToUsePyparsing.rst:1430:52

identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (raw pass, confidence 0.70)
```
    greek_word = pp.Word(ppu.Greek.alphas)
    greek_word[...].parse_string("Καλημέρα κόσμε")

The following language ranges are defined.
```
dismissed LLM, confidence 0.97 Greek word 'κόσμε' in a documentation example.
Reasoning
Greek word 'κόσμε' in a docs string literal demonstrating Greek parsing; homoglyph match is a false positive.
info ~~warn~~ → info by review unicode-mixed-script docs/HowToUsePyparsing.rst:1430:52

identifier `κόσμε` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
```
    greek_word = pp.Word(ppu.Greek.alphas)
    greek_word[...].parse_string("Καλημέρα κόσμε")

The following language ranges are defined.
```
dismissed LLM, confidence 0.95 Greek string in docs flagged for mixed scripts.
Reasoning
Greek documentation string flagged as mixed script; no genuine mixing of identifiers is present.
info ~~critical~~ → info by review dynamic-execution examples/cuneiform_python.py:104:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
print("# run transformed Python")
exec(transformed)
```
likely benign LLM, confidence 0.80 Module-level exec of a transformed Python source in a cuneiform codec example.
Reasoning
exec on transformed source at module scope is a known pattern in a codec/transform example that runs its own generated code; it is a dynamic execution of a non-literal, but in an example script rather than a dropper.
info ~~warn~~ → info by review dynamic-execution examples/dfmparse.py:33:38

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    """chr(x) if 0 < x < 128 ; unicode(x) if x > 127."""⟨U+000D⟩
    return 0 < x < 128 and chr(x) or eval("u'\\u%d'" % x)
```
likely benign LLM, confidence 0.70 eval used to build a unicode character from an integer code point.
Reasoning
eval on a constructed unicode escape string from an integer; a legitimate, if poor, character conversion in a parsing example, with input controlled by the local code.
info ~~warn~~ → info by review encoding-octal examples/dhcpd_leases_parser.py:27:8

7 consecutive `\NNN` octal escapes (entropy 2.8 bits/byte) (raw pass, confidence 0.65)
```
  hardware ethernet 00:17:f2:9b:d8:19;⟨U+000D⟩
  uid "\001\000\027\362\233\330\031";⟨U+000D⟩
}⟨U+000D⟩
lease 192.168.0.198 {
```
dismissed LLM, confidence 0.93 Sample DHCP lease data containing octal-escaped binary uid bytes.
Reasoning
Octal escapes are raw DHCP lease file sample data (binary DUID/uid bytes) embedded in a parser example; expected content, not obfuscation.
info ~~warn~~ → info by review dynamic-attribute examples/ebnf.py:154:12

reach-by-name through `vars` (ast pass, confidence 0.60)
```
for name in all_names:⟨U+000D⟩
    expr = vars()[name]⟨U+000D⟩
    action = vars()["do_" + name]⟨U+000D⟩
    expr.set_name(name)
```
likely benign LLM, confidence 0.85 Looks up grammar expressions and actions by name via vars() in an EBNF example.
Reasoning
vars() lookup by name to attach grammar actions is a common pyparsing example idiom; operates on local grammar names, not attacker input.
info ~~warn~~ → info by review dynamic-attribute examples/ebnf.py:155:14

reach-by-name through `vars` (ast pass, confidence 0.60)
```
    expr = vars()[name]⟨U+000D⟩
    action = vars()["do_" + name]⟨U+000D⟩
    expr.set_name(name)⟨U+000D⟩
    expr.add_parse_action(action)
```
likely benign LLM, confidence 0.85 Attaches parse actions by name via vars() in an EBNF example.
Reasoning
Same vars()-based name lookup for setting names and parse actions in a grammar example; benign metaprogramming.
info ~~critical~~ → info by review dynamic-execution examples/eval_arith.py:251:27

`eval` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
    t = t.replace("<>", "!=")
    tests.append((t_orig, eval(t, vars_)))

# copy vars_ to EvalConstant lookup dict
```
likely benign LLM, confidence 0.80 eval of arithmetic test expressions in an example script.
Reasoning
eval of test expressions in an arithmetic parser example with a restricted vars_ namespace; a standard demonstration pattern on trusted test strings.
info unicode-homoglyph examples/greetingInGreek.py:15:10

identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
```
# input string⟨U+000D⟩
hello = "Καλημέρα, κόσμε!"⟨U+000D⟩
⟨U+000D⟩
# parse input string
```
info unicode-mixed-script examples/greetingInGreek.py:15:10

identifier `Καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
# input string⟨U+000D⟩
hello = "Καλημέρα, κόσμε!"⟨U+000D⟩
⟨U+000D⟩
# parse input string
```
info unicode-homoglyph examples/greetingInGreek.py:15:28

identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
```
# input string⟨U+000D⟩
hello = "Καλημέρα, κόσμε!"⟨U+000D⟩
⟨U+000D⟩
# parse input string
```
info unicode-mixed-script examples/greetingInGreek.py:15:28

identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
# input string⟨U+000D⟩
hello = "Καλημέρα, κόσμε!"⟨U+000D⟩
⟨U+000D⟩
# parse input string
```
info ~~warn~~ → info by review dynamic-attribute examples/oc.py:147:9

reach-by-name through `vars` (ast pass, confidence 0.60)
```
):⟨U+000D⟩
    v = vars()[vname]⟨U+000D⟩
    v.set_name(vname)
```
likely benign LLM, confidence 0.85 Looks up grammar element by name via vars() to set its name.
Reasoning
vars() lookup by name to set names on grammar elements in an example; benign reflective idiom.
info ~~critical~~ → info by review dynamic-execution examples/protobuf_parser.py:33:5

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
for kw in kwds.split():
    exec("{}_ = Keyword('{}')".format(kw.upper(), kw))

messageBody = Forward()
```
likely benign LLM, confidence 0.80 exec used to generate Keyword definitions from a hardcoded keyword list.
Reasoning
exec generates keyword variable definitions from a fixed keyword list in a protobuf parser example; the input is a local constant string, not untrusted data.
info ~~warn~~ → info by review encoding-base64 examples/sexpParser.py:110:13

base64-like blob (60 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
```
        (e 15 |NFGq/E3wh9f4rJIQVXhS|)
        (n |d738/4ghP9rFZ0gAIYZ5q9y6iskDJwASi5rEQpEQq8ZyMZeIZzIAR2I5iGE=|))
       aid-committee))
     (subject
```
dismissed LLM, confidence 0.90 Sample S-expression containing base64-like key material in a parser example.
Reasoning
Base64-like text is an embedded sample S-expression payload (cryptographic key/signature data) in an example parser; no decoding or dropper behavior.
info ~~warn~~ → info by review encoding-base64 examples/sexpParser.py:117:13

base64-like blob (60 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
```
        (e |NFGq/E3wh9f4rJIQVXhS|)
        (n |d738/4ghP9rFZ0gAIYZ5q9y6iskDJwASi5rEQpEQq8ZyMZeIZzIAR2I5iGE=|))
       tom
       mother))
```
likely benign LLM, confidence 0.90 Base64-like substring inside a sample s-expression string in a parser example.
Reasoning
The raw base64-like match sits inside an s-expression test string of a parser example (names like tom, mother, e, n), so it is literal test data, not an encoded payload.
info ~~warn~~ → info by review dynamic-execution examples/simpleBool.py:28:22

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        self.label = t[0]⟨U+000D⟩
        self.value = eval(t[0])⟨U+000D⟩
⟨U+000D⟩
    def __bool__(self) -> bool:
```
likely benign LLM, confidence 0.80 eval of a parsed boolean expression token in a pyparsing example.
Reasoning
This is pyparsing's boolean expression example evaluating a parsed expression token. It is a known-demo pattern, but eval on parsed input is risky if the input is untrusted; in an example it is a dev-time convenience.
info ~~warn~~ → info by review dynamic-execution examples/statemachine/statemachine.py:364:19

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        codeobj = compile(generated_code.rstrip(" \t"), module.__file__, COMPILE_MODE)

        exec(codeobj, module.__dict__)
```
likely benign LLM, confidence 0.80 compile of generated state-machine source code in the library's code generator.
Reasoning
This is the pyparsing/statemachine code generator compiling generated Python source for its own module, a legitimate code-generation pattern, not hidden payload execution.
info ~~warn~~ → info by review dynamic-execution examples/statemachine/statemachine.py:366:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        exec(codeobj, module.__dict__)
```
likely benign LLM, confidence 0.80 exec of internally generated state-machine code into the module namespace.
Reasoning
exec runs the compiled code object into the module's own namespace as part of the library's generation mechanism; the code is generated internally rather than fetched from outside.
info ~~critical~~ → info by review dynamic-execution examples/statemachine/vending_machine.py:30:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
# exec generated code to define state classes and state mixin
exec(generated)
```
likely benign LLM, confidence 0.75 Module-level exec of generated state classes in a vending machine example.
Reasoning
Module-scope exec of generated code is a documented example pattern in the statemachine library; the generated string comes from the library itself, though running at import is notable.
info unicode-homoglyph examples/tag_metadata.py:38:16

identifier `κόσμος` contains homoglyph candidates: κ (03BA)→k, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)
```
        Hello, World!
        Hello, κόσμος?
        Hello, 世界!
        """
```
info unicode-mixed-script examples/tag_metadata.py:38:16

identifier `κόσμος` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
        Hello, World!
        Hello, κόσμος?
        Hello, 世界!
        """
```

info unicode-mixed-script examples/unicode_denormalizer.py:54:28

identifier `ﬀl` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

    'XI': ('Ⅺ', 'Ⅺ', 'XI'),
    'ffl': ('ﬄ', 'ﬄ', 'ﬀl', 'fﬂ', 'ffl'),
    'ffi': ('ﬃ', 'ﬃ', 'ﬀi', 'fﬁ', 'ffi'),
    'ff': ('ﬀ', 'ﬀ', 'ff'),

info unicode-mixed-script examples/unicode_denormalizer.py:54:36

identifier `fﬂ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    'XI': ('Ⅺ', 'Ⅺ', 'XI'),
    'ffl': ('ﬄ', 'ﬄ', 'ﬀl', 'fﬂ', 'ffl'),
    'ffi': ('ﬃ', 'ﬃ', 'ﬀi', 'fﬁ', 'ffi'),
    'ff': ('ﬀ', 'ﬀ', 'ff'),

info unicode-mixed-script examples/unicode_denormalizer.py:55:28

identifier `ﬀi` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

    'ffl': ('ﬄ', 'ﬄ', 'ﬀl', 'fﬂ', 'ffl'),
    'ffi': ('ﬃ', 'ﬃ', 'ﬀi', 'fﬁ', 'ffi'),
    'ff': ('ﬀ', 'ﬀ', 'ff'),
    'fi': ('ﬁ', 'ﬁ', 'fi'),

info unicode-mixed-script examples/unicode_denormalizer.py:55:36

identifier `fﬁ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

    'ffl': ('ﬄ', 'ﬄ', 'ﬀl', 'fﬂ', 'ffl'),
    'ffi': ('ﬃ', 'ﬃ', 'ﬀi', 'fﬁ', 'ffi'),
    'ff': ('ﬀ', 'ﬀ', 'ff'),
    'fi': ('ﬁ', 'ﬁ', 'fi'),

info ~~warn~~ → info by review dynamic-execution examples/unicode_denormalizer.py:148:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    # does it really work? compile the transformed code and run it!
    code = compile(transformed, "inline source", mode="exec")
    exec(code)
```
likely benign LLM, confidence 0.75 compile of transformed demo code in a unicode denormalizer self-test.
Reasoning
The file is a unicode denormalizer demo that compiles and runs its own transformed code as a self-test; the source is local, not attacker-supplied.
info ~~warn~~ → info by review dynamic-execution examples/unicode_denormalizer.py:149:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    code = compile(transformed, "inline source", mode="exec")
    exec(code)

    if 1:
```
likely benign LLM, confidence 0.75 exec of locally compiled transformed code in the denormalizer demo.
Reasoning
exec runs the locally compiled demo code as a self-check; the code is generated from the file's own transformation logic.
info ~~critical~~ → info by review dynamic-execution run_perf_all_tags.sh:98:5

command name is a variable (`$interp_cmd`) and `interp_cmd` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
```
  else
    "$interp_cmd" -m venv "$VENV_DIR" || { echo "Failed to create venv for Python $pv, skipping..."; continue; }
  fi
```
likely benign LLM, confidence 0.70 Interpreter command selected at runtime from a variable in a benchmark setup script.
Reasoning
The command name comes from a variable assigned from command output for selecting a Python interpreter, which is typical for a benchmark setup script. The variable is derived locally, not from remote input, so it is most likely benign.

info dynamic-execution run_perf_all_tags.sh:106:8

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

  echo "Upgrading pip and installing dependencies for Python $pv..."
  if ! "$PYTHON" -m pip install --upgrade pip setuptools wheel >/dev/null; then
    echo "Failed to upgrade pip for Python $pv, skipping this interpreter."
    continue

info dynamic-execution run_perf_all_tags.sh:110:8

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)

  fi
  if ! "$PIP" install littletable >/dev/null; then
    echo "Failed to install littletable for Python $pv, skipping this interpreter."
    continue

info dynamic-execution run_perf_all_tags.sh:114:8

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)

  fi
  if ! "$PIP" install rich >/dev/null; then
    echo "Failed to install rich for Python $pv, skipping this interpreter."
    continue

info dynamic-execution run_perf_all_tags.sh:127:5

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)

    echo "=== Running perf for Python $pv, pyparsing $v ==="
    "$PIP" uninstall -y pyparsing >/dev/null 2>&1 || true
    if ! "$PIP" install "pyparsing==$v"; then
      echo "Failed to install pyparsing $v on Python $pv, skipping..."

info dynamic-execution run_perf_all_tags.sh:128:10

command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)

    "$PIP" uninstall -y pyparsing >/dev/null 2>&1 || true
    if ! "$PIP" install "pyparsing==$v"; then
      echo "Failed to install pyparsing $v on Python $pv, skipping..."
      continue

info dynamic-execution run_perf_all_tags.sh:134:10

command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    export PYTHONUTF8=1
    if ! "$PYTHON" "$VENV_TMP/perf_pyparsing.py" --append-csv "$CSV"; then
      echo "perf run failed for pyparsing $v on Python $pv, continuing..."
      continue

info unicode-homoglyph tests/test_unit.py:1852:16

identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)

            r"[\x21]",
            r"[а-яА-ЯёЁA-Z$_\041α-ω]",
            r"[\0xc0-\0xd6\0xd8-\0xf6\0xf8-\0xff]",
            r"[\0xa1-\0xbf\0xd7\0xf7]",

info unicode-mixed-script tests/test_unit.py:1852:24

identifier `ЯёЁA` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

            r"[\x21]",
            r"[а-яА-ЯёЁA-Z$_\041α-ω]",
            r"[\0xc0-\0xd6\0xd8-\0xf6\0xf8-\0xff]",
            r"[\0xa1-\0xbf\0xd7\0xf7]",

info unicode-homoglyph tests/test_unit.py:1852:39

identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

            r"[\x21]",
            r"[а-яА-ЯёЁA-Z$_\041α-ω]",
            r"[\0xc0-\0xd6\0xd8-\0xf6\0xf8-\0xff]",
            r"[\0xa1-\0xbf\0xd7\0xf7]",

info unicode-zero-width tests/test_unit.py:1867:38

U+00AD SOFT HYPHEN in source (in string/comment) (raw pass, confidence 0.45)

            "¡¢£¤¥¦§¨©ª«¬⟨U+00AD⟩®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþ",
            " !\"#$%&'()*+,-./0",
            "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",

info unicode-homoglyph tests/test_unit.py:1880:14

identifier `абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ` contains homoglyph candidates: а (0430)→a, е (0435)→e, о (043E)→o, р (0440)→p (in string/comment) (raw pass, confidence 0.35)
```
            "!",
            "абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ$_!αβγδεζηθικλμνξοπρςστυφχψω",
```
info unicode-mixed-script tests/test_unit.py:1880:14

identifier `абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
```
            "!",
            "абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ$_!αβγδεζηθικλμνξοπρςστυφχψω",
```

info unicode-homoglyph tests/test_unit.py:1880:175

identifier `αβγδεζηθικλμνξοπρςστυφχψω` contains homoglyph candidates: α (03B1)→a, η (03B7)→n, κ (03BA)→k, ν (03BD)→v (in string/comment) (raw pass, confidence 0.35)

            "!",
            "абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ$_!αβγδεζηθικλμνξοπρςστυφχψω",

info unicode-mixed-script tests/test_unit.py:1880:175

identifier `αβγδεζηθικλμνξοπρςστυφχψω` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

            "!",
            "абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ$_!αβγδεζηθικλμνξοπρςστυφχψω",

info ~~warn~~ → info by review decoder-import-with-exec tests/test_unit.py:2687:24

file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
            print(t, "\n", res[0], "=", bool(res[0]), "\n")
            expected = eval(t, {}, boolVars)
            self.assertEqual(expected, bool(res[0]), f"failed boolean eval test {t}")
```
likely benign LLM, confidence 0.85 eval of boolean test expressions in the pyparsing unit test file.
Reasoning
This is a pyparsing boolean test suite evaluating test expressions with a restricted namespace; the decoder-import heuristic fires on the test module importing pickle and using eval, which is ordinary test scaffolding.
info ~~warn~~ → info by review dynamic-execution tests/test_unit.py:2687:24

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            print(t, "\n", res[0], "=", bool(res[0]), "\n")
            expected = eval(t, {}, boolVars)
            self.assertEqual(expected, bool(res[0]), f"failed boolean eval test {t}")
```
likely benign LLM, confidence 0.85 eval of test expressions in a unit test.
Reasoning
Same eval of test expressions with an explicit dictionary of boolean variables in a unit test; no hidden payload or untrusted input.
info ~~warn~~ → info by review dynamic-execution tests/test_unit.py:2834:17

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            self.assertEqual(
                eval(t),
                eval_value,
                f"Error evaluating {t!r}, expected {eval(t)!r}, got {eval_value!r}",
```
likely benign LLM, confidence 0.85 eval of test strings inside an assertion in the unit test file.
Reasoning
eval is used in a test assertion message to compute the expected value for test strings defined in the test file itself.
info ~~warn~~ → info by review dynamic-execution tests/test_unit.py:2836:53

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
                eval_value,
                f"Error evaluating {t!r}, expected {eval(t)!r}, got {eval_value!r}",
            )
```
likely benign LLM, confidence 0.85 eval of test strings within a failure message in the unit test file.
Reasoning
Repeated eval of local test strings within an assertion message in the unit test; standard test helper behavior.
info unicode-homoglyph tests/test_unit.py:8737:18

identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
```
        # input string
        hello = "Καλημέρα, κόσμε!"
        result = greet.parse_string(hello, parse_all=True)
        print(result)
```

info unicode-mixed-script tests/test_unit.py:8737:18

identifier `Καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

        # input string
        hello = "Καλημέρα, κόσμε!"
        result = greet.parse_string(hello, parse_all=True)
        print(result)

info unicode-homoglyph tests/test_unit.py:8737:36

identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)

        # input string
        hello = "Καλημέρα, κόσμε!"
        result = greet.parse_string(hello, parse_all=True)
        print(result)

info unicode-mixed-script tests/test_unit.py:8737:36

identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

        # input string
        hello = "Καλημέρα, κόσμε!"
        result = greet.parse_string(hello, parse_all=True)
        print(result)

info unicode-homoglyph tests/test_unit.py:8742:29

identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

            result,
            expected_list=["Καλημέρα", ",", "κόσμε", "!"],
            msg="Failed to parse Greek 'Hello, World!' using "
            "pyparsing_unicode.Greek.alphas",

info unicode-mixed-script tests/test_unit.py:8742:29

identifier `Καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

            result,
            expected_list=["Καλημέρα", ",", "κόσμε", "!"],
            msg="Failed to parse Greek 'Hello, World!' using "
            "pyparsing_unicode.Greek.alphas",

info unicode-homoglyph tests/test_unit.py:8742:54

identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)

            result,
            expected_list=["Καλημέρα", ",", "κόσμε", "!"],
            msg="Failed to parse Greek 'Hello, World!' using "
            "pyparsing_unicode.Greek.alphas",

info unicode-mixed-script tests/test_unit.py:8742:54

identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

            result,
            expected_list=["Καλημέρα", ",", "κόσμε", "!"],
            msg="Failed to parse Greek 'Hello, World!' using "
            "pyparsing_unicode.Greek.alphas",

info unicode-homoglyph tests/test_unit.py:10412:22

identifier `кириллицаx_10` contains homoglyph candidates: р (0440)→p, а (0430)→a (in string/comment) (raw pass, confidence 0.35)

        result = idents[...].parse_string(
            "abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
            parse_all=True,
        )

info unicode-mixed-script tests/test_unit.py:10412:22

identifier `кириллицаx_10` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

        result = idents[...].parse_string(
            "abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
            parse_all=True,
        )

info unicode-mixed-script tests/test_unit.py:10412:60

identifier `ไทยg_600` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

        result = idents[...].parse_string(
            "abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
            parse_all=True,
        )

info unicode-homoglyph tests/test_unit.py:10412:117

identifier `Ελληνικάb_500` contains homoglyph candidates: Ε (0395)→E, η (03B7)→n, ν (03BD)→v, κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)

        result = idents[...].parse_string(
            "abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
            parse_all=True,
        )

info unicode-mixed-script tests/test_unit.py:10412:117

identifier `Ελληνικάb_500` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

        result = idents[...].parse_string(
            "abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
            parse_all=True,
        )

info unicode-homoglyph tests/test_unit.py:10419:18

identifier `кириллицаx_10` contains homoglyph candidates: р (0440)→p, а (0430)→a (in string/comment) (raw pass, confidence 0.35)

                "abc_100",
                "кириллицаx_10",
                "日本語f_300",
                "ไทยg_600",

info unicode-mixed-script tests/test_unit.py:10419:18

identifier `кириллицаx_10` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

                "abc_100",
                "кириллицаx_10",
                "日本語f_300",
                "ไทยg_600",

info unicode-mixed-script tests/test_unit.py:10421:18

identifier `ไทยg_600` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

                "日本語f_300",
                "ไทยg_600",
                "def_200",
                "漢字y_300",

info unicode-homoglyph tests/test_unit.py:10425:18

identifier `Ελληνικάb_500` contains homoglyph candidates: Ε (0395)→E, η (03B7)→n, ν (03BD)→v, κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
```
                "한국어_中文c_400",
                "Ελληνικάb_500",
            ],
            {
```

info unicode-mixed-script tests/test_unit.py:10425:18

identifier `Ελληνικάb_500` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

                "한국어_中文c_400",
                "Ελληνικάb_500",
            ],
            {

info unicode-homoglyph tests/test_unit.py:10429:31

identifier `кириллицаx_10` contains homoglyph candidates: р (0440)→p, а (0430)→a (in string/comment) (raw pass, confidence 0.35)

                "cjk": ["한국어_中文c_400"],
                "cyrillic": ["кириллицаx_10"],
                "greek": ["Ελληνικάb_500"],
                "japanese": ["日本語f_300", "漢字y_300"],

info unicode-mixed-script tests/test_unit.py:10429:31

identifier `кириллицаx_10` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)

                "cjk": ["한국어_中文c_400"],
                "cyrillic": ["кириллицаx_10"],
                "greek": ["Ελληνικάb_500"],
                "japanese": ["日本語f_300", "漢字y_300"],

info unicode-homoglyph tests/test_unit.py:10430:28

identifier `Ελληνικάb_500` contains homoglyph candidates: Ε (0395)→E, η (03B7)→n, ν (03BD)→v, κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)

                "cyrillic": ["кириллицаx_10"],
                "greek": ["Ελληνικάb_500"],
                "japanese": ["日本語f_300", "漢字y_300"],
                "latin": ["abc_100", "def_200"],

info unicode-mixed-script tests/test_unit.py:10430:28

identifier `Ελληνικάb_500` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

                "cyrillic": ["кириллицаx_10"],
                "greek": ["Ελληνικάb_500"],
                "japanese": ["日本語f_300", "漢字y_300"],
                "latin": ["abc_100", "def_200"],

info unicode-mixed-script tests/test_unit.py:10433:27

identifier `ไทยg_600` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

                "latin": ["abc_100", "def_200"],
                "thai": ["ไทยg_600"],
            },
        )

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pyparsing/pyparsing pyparsing && cd pyparsing
git checkout 3.3.3
disclude scan --severity info --diff 3.3.2 .