Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (raw pass, confidence 0.70)
greek_word = pp.Word(ppu.Greek.alphas)
greek_word[...].parse_string("Καλημέρα κόσμε")
The following language ranges are defined.
likely benign
LLM, confidence 0.90
Greek sample word inside a pyparsing docs example.
Reasoning
Greek text in a documentation example demonstrating Unicode parsing; homoglyph flag is a false positive because the identifier is a Greek string literal, not a code identifier spoofing Latin.
-
identifier `Καλημέρα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
greek_word = pp.Word(ppu.Greek.alphas)
greek_word[...].parse_string("Καλημέρα κόσμε")
The following language ranges are defined.
likely benign
LLM, confidence 0.90
Greek text sample in pyparsing documentation.
Reasoning
The string is intentionally multilingual text in a parsing documentation example; mixed-script detection here is a false positive from string content.
-
identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (raw pass, confidence 0.70)
greek_word = pp.Word(ppu.Greek.alphas)
greek_word[...].parse_string("Καλημέρα κόσμε")
The following language ranges are defined.
likely benign
LLM, confidence 0.90
Greek sample word used as parser input in docs.
Reasoning
Greek word in a parse_string demo string, not an identifier; no deceptive intent.
-
identifier `κόσμε` mixes scripts: Greek + Latin (raw pass, confidence 0.80)
greek_word = pp.Word(ppu.Greek.alphas)
greek_word[...].parse_string("Καλημέρα κόσμε")
The following language ranges are defined.
likely benign
LLM, confidence 0.90
Greek sample text in pyparsing docs.
Reasoning
Same documentation Greek sample; mixed-script flag reflects legitimate multilingual demo text.
-
line length 602 characters (raw pass, confidence 0.50)
<path d="M260.0 272h0.0" /><path d="M722.0 272h0.0" /><rect height="22" width="462" x="260" y="261"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="491" y="276">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'"</tex
-
line length 602 characters (raw pass, confidence 0.50)
<path d="M260.0 585h0.0" /><path d="M722.0 585h0.0" /><rect height="22" width="462" x="260" y="574"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="491" y="589">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'"</tex
-
line length 602 characters (raw pass, confidence 0.50)
<path d="M260.0 182h0.0" /><path d="M722.0 182h0.0" /><rect height="22" width="462" x="260" y="171"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="491" y="186">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'"</tex
-
line length 602 characters (raw pass, confidence 0.50)
<path d="M260.0 495h0.0" /><path d="M722.0 495h0.0" /><rect height="22" width="462" x="260" y="484"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="491" y="499">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'"</tex
-
line length 615 characters (raw pass, confidence 0.50)
<path d="M338.75 211h0.0" /><path d="M800.75 211h0.0" /><rect height="22" width="462" x="338.75" y="200"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="569.75" y="215">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'&qu
-
line length 615 characters (raw pass, confidence 0.50)
<path d="M338.75 533h0.0" /><path d="M800.75 533h0.0" /><rect height="22" width="462" x="338.75" y="522"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="569.75" y="537">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'&qu
-
line length 525 characters (raw pass, confidence 0.50)
<path d="M496.0 1276h0.0" /><path d="M643.5 1276h0.0" /><rect height="22" width="147.5" x="496" y="1265"></rect><a xlink:href="#z-0065"><text x="569.75" y="1280">'?' | '*' | '+'</text><text x="569.75" y="1280">'?' | '*' | '+'</text></a></g><path d="M643.5 1276
-
line length 609 characters (raw pass, confidence 0.50)
<path d="M240.0 1378h0.0" /><path d="M702.0 1378h0.0" /><rect height="22" width="462" x="240" y="1367"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="471" y="1382">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'"<
-
line length 609 characters (raw pass, confidence 0.50)
<path d="M240.0 1700h0.0" /><path d="M702.0 1700h0.0" /><rect height="22" width="462" x="240" y="1689"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="471" y="1704">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'"<
-
line length 592 characters (raw pass, confidence 0.50)
<path d="M80.0 71h0.0" /><path d="M542.0 71h0.0" /><rect height="22" width="462" x="80" y="60"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="311" y="75">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'"</text><tex
-
line length 595 characters (raw pass, confidence 0.50)
<path d="M194.0 95h0.0" /><path d="M656.0 95h0.0" /><rect height="22" width="462" x="194" y="84"></rect><a xlink:href="#z-n-r-t-b-f-0011"><text x="425" y="99">'n' | 'r' | 't' | 'b' | 'f' | '\\' | '"' | '>' | "'"</text><t
-
`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
print("# run transformed Python")
exec(transformed)
likely benign
LLM, confidence 0.80
Example script executing transformed Python code at module scope.
Reasoning
This is a transpiler example that executes code it just generated from a source-to-source transformation; exec of a generated string is expected in a demo, though it runs on import, which is a notable pattern for an example.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
⟨U+000D⟩
return 0 < x < 128 and chr(x) or eval("u'\\u%d'" % x)
likely benign
LLM, confidence 0.80
eval used to build a unicode character from an integer.
Reasoning
eval on a constructed unicode escape string for a Delphi DFM parser helper; it is a formatted integer, so low risk, though eval is unnecessary.
-
7 consecutive `\NNN` octal escapes (entropy 2.8 bits/byte) (raw pass, confidence 0.65)
hardware ethernet 00:17:f2:9b:d8:19;⟨U+000D⟩
uid "\001\000\027\362\233\330\031";⟨U+000D⟩
}⟨U+000D⟩
lease 192.168.0.198 {
likely benign
LLM, confidence 0.90
Sample DHCP lease file containing binary uid octal escapes.
Reasoning
Octal escapes are binary DHCP lease data (uid field) embedded in sample text for a parser example; not obfuscation.
-
reach-by-name through `vars` (ast pass, confidence 0.60)
for name in all_names:⟨U+000D⟩
expr = vars()[name]⟨U+000D⟩
action = vars()["do_" + name]⟨U+000D⟩
expr.set_name(name)
likely benign
LLM, confidence 0.90
Reflective lookup of grammar elements via vars() in an example.
Reasoning
Looking up grammar expressions and parse actions by name from locals in an example EBNF parser; a common pyparsing idiom with no external input reaching it.
-
reach-by-name through `vars` (ast pass, confidence 0.60)
expr = vars()[name]⟨U+000D⟩
action = vars()["do_" + name]⟨U+000D⟩
expr.set_name(name)⟨U+000D⟩
expr.add_parse_action(action)
likely benign
LLM, confidence 0.90
Reflective attachment of parse actions by name.
Reasoning
Same vars()-based name lookup of parse actions in a grammar example; benign reflection.
-
`eval` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
t = t.replace("<>", "!=")
tests.append((t_orig, eval(t, vars_)))
likely benign
LLM, confidence 0.80
eval of test expressions for an arithmetic parser demo.
Reasoning
eval of test expressions in an arithmetic evaluator example, with a fixed test list; not attacker-controlled input in this context.
-
identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
hello = "Καλημέρα, κόσμε!"⟨U+000D⟩
⟨U+000D⟩
-
identifier `Καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
hello = "Καλημέρα, κόσμε!"⟨U+000D⟩
⟨U+000D⟩
-
identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
hello = "Καλημέρα, κόσμε!"⟨U+000D⟩
⟨U+000D⟩
-
identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
hello = "Καλημέρα, κόσμε!"⟨U+000D⟩
⟨U+000D⟩
-
line length 532 characters (raw pass, confidence 0.50)
<path d="M593.5 47h0.0" /><path d="M1021.5 47h0.0" /><rect height="22" width="428" x="593.5" y="36"></rect><a xlink:href="#z-operations-0045"><text x="807.5" y="51">'<=' | '<' | '>=' | '>' | '~=' | '==' operations</text><text x="807.5" y="51">'<=
-
line length 563 characters (raw pass, confidence 0.50)
<path d="M1071.5 47h10.0" /><path d="M1509.5 47h10.0" /><rect height="22" width="428" x="1081.5" y="36"></rect><a xlink:href="#z-operations-0045"><text x="1295.5" y="51">'<=' | '<' | '>=' | '>' | '~=' | '==' operations</text><text x="1295.5" y="51">&apos
-
line length 515 characters (raw pass, confidence 0.50)
<path d="M191.0 56h0.0" /><path d="M525.5 56h0.0" /><rect height="22" width="334.5" x="191" y="45"></rect><a xlink:href="#z-not-in-like-operations-0005"><text x="358.25" y="60">{'not' ~{{'in' | 'like'}}} operations</text><text x="358.25" y="60">{'not' ~{{'in' | 'li
-
reach-by-name through `vars` (ast pass, confidence 0.60)
):⟨U+000D⟩
v = vars()[vname]⟨U+000D⟩
v.set_name(vname)
likely benign
LLM, confidence 0.90
Name-based lookup of grammar elements in an example script.
Reasoning
vars() lookup of locally defined grammar names in an example; benign reflection pattern.
-
`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
for kw in kwds.split():
exec("{}_ = Keyword('{}')".format(kw.upper(), kw))
messageBody = Forward()
likely benign
LLM, confidence 0.85
exec used to generate keyword variable definitions.
Reasoning
exec defining keyword variables from a fixed keyword list in a parser example; code generation from trusted static strings.
-
line length 541 characters (raw pass, confidence 0.50)
<path d="M1676.0 125h0.0" /><path d="M1721.5 125h0.0" /><rect height="22" width="45.5" x="1676" y="114"></rect><a xlink:href="#one-0013"><text x="1698.75" y="129">one</text><text x="1698.75" y="129">one</text></a></g><path d="M1721.5 125h20" /></g></g><path d="M1741.5 125h20" /></g></g><path d="M1761.5 125h20" /></g></
-
base64-like blob (60 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
(e 15 |NFGq/E3wh9f4rJIQVXhS|)
(n |d738/4ghP9rFZ0gAIYZ5q9y6iskDJwASi5rEQpEQq8ZyMZeIZzIAR2I5iGE=|))
aid-committee))
(subject
likely benign
LLM, confidence 0.90
Sample S-expression containing encoded key material.
Reasoning
Base64-like text is an S-expression cryptographic key sample (RSA public key values) in a parser test; expected data.
-
base64-like blob (60 bytes, compression ratio 1.18) (raw pass, confidence 0.60)
(e |NFGq/E3wh9f4rJIQVXhS|)
(n |d738/4ghP9rFZ0gAIYZ5q9y6iskDJwASi5rEQpEQq8ZyMZeIZzIAR2I5iGE=|))
tom
mother))
likely benign
LLM, confidence 0.90
Sample S-expression with encoded key values.
Reasoning
Same sample S-expression key data in the parser example; expected content.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
self.label = t[0]⟨U+000D⟩
self.value = eval(t[0])⟨U+000D⟩
⟨U+000D⟩
def __bool__(self) -> bool:
likely benign
LLM, confidence 0.85
eval of parsed boolean token in an example.
Reasoning
eval on the parsed token of a boolean expression example; grammar-restricted input in a demo, low risk here.
-
`compile` called on a non-literal expression (ast pass, confidence 0.70)
codeobj = compile(generated_code.rstrip(" \t"), module.__file__, COMPILE_MODE)
exec(codeobj, module.__dict__)
likely benign
LLM, confidence 0.85
Compiles generated state machine module code.
Reasoning
compile of generated state machine code from the library's own code generator; legitimate code generation feature of statemachine.
-
`exec` called on a non-literal expression (ast pass, confidence 0.70)
exec(codeobj, module.__dict__)
likely benign
LLM, confidence 0.85
Executes generated state machine module code.
Reasoning
Executes the compiled code object into the generated module namespace, the expected behavior of the statemachine code generator.
-
`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
exec(generated)
likely benign
LLM, confidence 0.80
Example state machine uses exec to define generated state classes at import.
Reasoning
Module-scope exec of generated code in an example state-machine library is a code-generation pattern; the code is generated locally, not an obfuscated payload. Still, exec on a non-literal at import time is a risky pattern worth noting.
-
identifier `κόσμος` contains homoglyph candidates: κ (03BA)→k, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)
Hello, World!
Hello, κόσμος?
Hello, 世界!
-
identifier `κόσμος` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
Hello, World!
Hello, κόσμος?
Hello, 世界!
-
identifier `〵〻〼ぁ` mixes scripts: Other + Hiragana (raw pass, confidence 0.80)
<path d="M80.0 131h0.0" /><path d="M270.0 131h0.0" /><rect height="22" rx="10" ry="10" width="190" x="80" y="120"></rect><text x="175" y="135">W:(々〆〱-〵〻〼ぁ-ゖゝ-ゟ...)</text></g><path d="M270.0 131h10" /><path d="M280.0 131h10" /><g class="terminal ">
dismissed
LLM, confidence 0.85
SVG diagram label contains Japanese character-class notation flagged as mixed script.
Reasoning
Mixed-script identifier warning comes from a railroad diagram text label containing CJK iteration marks and Hiragana in a character-range description string, not an identifier; a rendering artifact of documentation content.
-
line length 558 characters (raw pass, confidence 0.50)
<path d="M50.0 31h0.0" /><path d="M469.5 31h0.0" /><rect height="22" width="419.5" x="50" y="20"></rect><a xlink:href="#z-operations-0022"><text x="259.75" y="35">'<>' | '<=' | '<' | '>=' | '>' | '=' operations</text><text x="259.75" y="35">'<
-
line length 558 characters (raw pass, confidence 0.50)
<path d="M50.0 31h0.0" /><path d="M469.5 31h0.0" /><rect height="22" width="419.5" x="50" y="20"></rect><a xlink:href="#z-operations-0021"><text x="259.75" y="35">'<>' | '<=' | '<' | '>=' | '>' | '=' operations</text><text x="259.75" y="35">'<
-
identifier `ffl` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
'XI': ('Ⅺ', 'Ⅺ', 'XI'),
'ffl': ('ffl', 'ffl', 'ffl', 'ffl', 'ffl'),
'ffi': ('ffi', 'ffi', 'ffi', 'ffi', 'ffi'),
'ff': ('ff', 'ff', 'ff'),
-
identifier `ffl` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
'XI': ('Ⅺ', 'Ⅺ', 'XI'),
'ffl': ('ffl', 'ffl', 'ffl', 'ffl', 'ffl'),
'ffi': ('ffi', 'ffi', 'ffi', 'ffi', 'ffi'),
'ff': ('ff', 'ff', 'ff'),
-
identifier `ffi` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
'ffl': ('ffl', 'ffl', 'ffl', 'ffl', 'ffl'),
'ffi': ('ffi', 'ffi', 'ffi', 'ffi', 'ffi'),
'ff': ('ff', 'ff', 'ff'),
'fi': ('fi', 'fi', 'fi'),
-
identifier `ffi` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
'ffl': ('ffl', 'ffl', 'ffl', 'ffl', 'ffl'),
'ffi': ('ffi', 'ffi', 'ffi', 'ffi', 'ffi'),
'ff': ('ff', 'ff', 'ff'),
'fi': ('fi', 'fi', 'fi'),
-
`compile` called on a non-literal expression (ast pass, confidence 0.70)
code = compile(transformed, "inline source", mode="exec")
exec(code)
likely benign
LLM, confidence 0.85
Demo script compiles and executes its transformed code as a self-check.
Reasoning
The file is a unicode denormalizer example that deliberately compiles and runs transformed source to test itself. The exec is of a locally produced, self-test string in an example demonstrating the tool's own transform, consistent with a legitimate demo.
-
`exec` called on a non-literal expression (ast pass, confidence 0.70)
code = compile(transformed, "inline source", mode="exec")
exec(code)
if 1:
likely benign
LLM, confidence 0.85
Demo script executes the compiled output of its own transform.
Reasoning
Same self-test pattern: exec of the compiled transformed code within an example script; the code is the script's own output, not external input.
-
`eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)
eval "$interp_cmd -m venv \"$VENV_DIR\"" || { echo "Failed to create venv for Python $pv, skipping..."; continue; }
else
likely benign
LLM, confidence 0.80
Benchmark script evals a venv creation command built from interpreter variables.
Reasoning
eval of a constructed command string containing a variable interpreter command and venv path. The eval is used to create virtualenvs for different Python versions; the inputs are local script variables, so it is a common but unsafe shell idiom rather than malicious.
-
command name is a variable (`$interp_cmd`) and `interp_cmd` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)
else
"$interp_cmd" -m venv "$VENV_DIR" || { echo "Failed to create venv for Python $pv, skipping..."; continue; }
fi
likely benign
LLM, confidence 0.80
Script runs a runtime-selected Python interpreter to create a venv.
Reasoning
Executing a variable command name assigned from detected interpreter output is a normal way to select among Python interpreters for venv creation. No download, decoding, or remote input is involved.
-
command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)
echo "Upgrading pip and installing dependencies for Python $pv..."
if ! "$PYTHON" -m pip install --upgrade pip setuptools wheel >/dev/null; then
echo "Failed to upgrade pip for Python $pv, skipping this interpreter."
continue
-
command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
fi
if ! "$PIP" install littletable >/dev/null; then
echo "Failed to install littletable for Python $pv, skipping this interpreter."
continue
-
command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
fi
if ! "$PIP" install rich >/dev/null; then
echo "Failed to install rich for Python $pv, skipping this interpreter."
continue
-
command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
echo "=== Running perf for Python $pv, pyparsing $v ==="
"$PIP" uninstall -y pyparsing >/dev/null 2>&1 || true
if ! "$PIP" install "pyparsing==$v"; then
echo "Failed to install pyparsing $v on Python $pv, skipping..."
-
command name is a variable (`$PIP`) that this file sets only to plain text (ast pass, confidence 0.40)
"$PIP" uninstall -y pyparsing >/dev/null 2>&1 || true
if ! "$PIP" install "pyparsing==$v"; then
echo "Failed to install pyparsing $v on Python $pv, skipping..."
continue
-
command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)
export PYTHONUTF8=1
if ! "$PYTHON" "$VENV_TMP/perf_pyparsing.py" --append-csv "$CSV"; then
echo "perf run failed for pyparsing $v on Python $pv, continuing..."
continue
-
identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)
r"[\x21]",
r"[а-яА-ЯёЁA-Z$_\041α-ω]",
r"[\0xc0-\0xd6\0xd8-\0xf6\0xf8-\0xff]",
r"[\0xa1-\0xbf\0xd7\0xf7]",
-
identifier `ЯёЁA` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
r"[\x21]",
r"[а-яА-ЯёЁA-Z$_\041α-ω]",
r"[\0xc0-\0xd6\0xd8-\0xf6\0xf8-\0xff]",
r"[\0xa1-\0xbf\0xd7\0xf7]",
-
identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
r"[\x21]",
r"[а-яА-ЯёЁA-Z$_\041α-ω]",
r"[\0xc0-\0xd6\0xd8-\0xf6\0xf8-\0xff]",
r"[\0xa1-\0xbf\0xd7\0xf7]",
-
U+00AD SOFT HYPHEN in source (in string/comment) (raw pass, confidence 0.45)
"¡¢£¤¥¦§¨©ª«¬⟨U+00AD⟩®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþ",
" !\"#$%&'()*+,-./0",
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
-
identifier `абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ` contains homoglyph candidates: а (0430)→a, е (0435)→e, о (043E)→o, р (0440)→p (in string/comment) (raw pass, confidence 0.35)
"!",
"абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ$_!αβγδεζηθικλμνξοπρςστυφχψω",
-
identifier `абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
"!",
"абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ$_!αβγδεζηθικλμνξοπρςστυφχψω",
-
identifier `αβγδεζηθικλμνξοπρςστυφχψω` contains homoglyph candidates: α (03B1)→a, η (03B7)→n, κ (03BA)→k, ν (03BD)→v (in string/comment) (raw pass, confidence 0.35)
"!",
"абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ$_!αβγδεζηθικλμνξοπρςστυφχψω",
-
identifier `αβγδεζηθικλμνξοπρςστυφχψω` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
"!",
"абвгдежзийклмнопрстуфхцчшщъыьэюяАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯёЁABCDEFGHIJKLMNOPQRSTUVWXYZ$_!αβγδεζηθικλμνξοπρςστυφχψω",
-
file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
print(t, "\n", res[0], "=", bool(res[0]), "\n")
expected = eval(t, {}, boolVars)
self.assertEqual(expected, bool(res[0]), f"failed boolean eval test {t}")
likely benign
LLM, confidence 0.80
Unit test evaluates boolean test expressions with a restricted namespace.
Reasoning
Test file for a boolean expression library evaluates test strings with eval using a restricted namespace. The pickle import reflects the library's own tests, not a multi-stage payload; the decoder-import heuristic is misfiring on test code.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
print(t, "\n", res[0], "=", bool(res[0]), "\n")
expected = eval(t, {}, boolVars)
self.assertEqual(expected, bool(res[0]), f"failed boolean eval test {t}")
likely benign
LLM, confidence 0.80
Unit test uses eval on test-case expression strings.
Reasoning
eval of test expression strings in a unit test for a parsing library; the expressions are fixed test fixtures, so this is ordinary test harness behavior.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
self.assertEqual(
eval(t),
eval_value,
f"Error evaluating {t!r}, expected {eval(t)!r}, got {eval_value!r}",
likely benign
LLM, confidence 0.85
Test assertion evaluates expression strings to compare results.
Reasoning
eval used in a test assertion to compare expected values for test expressions. Inputs are test fixtures within a test suite; typical of library testing.
-
`eval` called on a non-literal expression (ast pass, confidence 0.70)
eval_value,
f"Error evaluating {t!r}, expected {eval(t)!r}, got {eval_value!r}",
)
likely benign
LLM, confidence 0.85
Test assertion message evaluates expression strings.
Reasoning
Same test-harness eval used inside the assertion message; fixture-driven and benign.
-
identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
hello = "Καλημέρα, κόσμε!"
result = greet.parse_string(hello, parse_all=True)
print(result)
-
identifier `Καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
hello = "Καλημέρα, κόσμε!"
result = greet.parse_string(hello, parse_all=True)
print(result)
-
identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
hello = "Καλημέρα, κόσμε!"
result = greet.parse_string(hello, parse_all=True)
print(result)
-
identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
hello = "Καλημέρα, κόσμε!"
result = greet.parse_string(hello, parse_all=True)
print(result)
-
identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
result,
expected_list=["Καλημέρα", ",", "κόσμε", "!"],
msg="Failed to parse Greek 'Hello, World!' using "
"pyparsing_unicode.Greek.alphas",
-
identifier `Καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
result,
expected_list=["Καλημέρα", ",", "κόσμε", "!"],
msg="Failed to parse Greek 'Hello, World!' using "
"pyparsing_unicode.Greek.alphas",
-
identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
result,
expected_list=["Καλημέρα", ",", "κόσμε", "!"],
msg="Failed to parse Greek 'Hello, World!' using "
"pyparsing_unicode.Greek.alphas",
-
identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
result,
expected_list=["Καλημέρα", ",", "κόσμε", "!"],
msg="Failed to parse Greek 'Hello, World!' using "
"pyparsing_unicode.Greek.alphas",
-
identifier `кириллицаx_10` contains homoglyph candidates: р (0440)→p, а (0430)→a (in string/comment) (raw pass, confidence 0.35)
result = idents[...].parse_string(
"abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
parse_all=True,
)
-
identifier `кириллицаx_10` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
result = idents[...].parse_string(
"abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
parse_all=True,
)
-
identifier `ไทยg_600` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
result = idents[...].parse_string(
"abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
parse_all=True,
)
-
identifier `Ελληνικάb_500` contains homoglyph candidates: Ε (0395)→E, η (03B7)→n, ν (03BD)→v, κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
result = idents[...].parse_string(
"abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
parse_all=True,
)
-
identifier `Ελληνικάb_500` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
result = idents[...].parse_string(
"abc_100 кириллицаx_10 日本語f_300 ไทยg_600 def_200 漢字y_300 한국어_中文c_400 Ελληνικάb_500",
parse_all=True,
)
-
identifier `кириллицаx_10` contains homoglyph candidates: р (0440)→p, а (0430)→a (in string/comment) (raw pass, confidence 0.35)
"abc_100",
"кириллицаx_10",
"日本語f_300",
"ไทยg_600",
-
identifier `кириллицаx_10` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
"abc_100",
"кириллицаx_10",
"日本語f_300",
"ไทยg_600",
-
identifier `ไทยg_600` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
"日本語f_300",
"ไทยg_600",
"def_200",
"漢字y_300",
-
identifier `Ελληνικάb_500` contains homoglyph candidates: Ε (0395)→E, η (03B7)→n, ν (03BD)→v, κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
"한국어_中文c_400",
"Ελληνικάb_500",
],
{
-
identifier `Ελληνικάb_500` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
"한국어_中文c_400",
"Ελληνικάb_500",
],
{
-
identifier `кириллицаx_10` contains homoglyph candidates: р (0440)→p, а (0430)→a (in string/comment) (raw pass, confidence 0.35)
"cjk": ["한국어_中文c_400"],
"cyrillic": ["кириллицаx_10"],
"greek": ["Ελληνικάb_500"],
"japanese": ["日本語f_300", "漢字y_300"],
-
identifier `кириллицаx_10` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
"cjk": ["한국어_中文c_400"],
"cyrillic": ["кириллицаx_10"],
"greek": ["Ελληνικάb_500"],
"japanese": ["日本語f_300", "漢字y_300"],
-
identifier `Ελληνικάb_500` contains homoglyph candidates: Ε (0395)→E, η (03B7)→n, ν (03BD)→v, κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
"cyrillic": ["кириллицаx_10"],
"greek": ["Ελληνικάb_500"],
"japanese": ["日本語f_300", "漢字y_300"],
"latin": ["abc_100", "def_200"],
-
identifier `Ελληνικάb_500` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
"cyrillic": ["кириллицаx_10"],
"greek": ["Ελληνικάb_500"],
"japanese": ["日本語f_300", "漢字y_300"],
"latin": ["abc_100", "def_200"],
-
identifier `ไทยg_600` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)
"latin": ["abc_100", "def_200"],
"thai": ["ไทยg_600"],
},
)
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io