disclude.iopypdf 6.21.1
- Source
- https://github.com/py-pdf/pypdf
- Tag scanned
6.21.1- Compared with
6.21.0(0 signals introduced since)- Files
- 187 scanned, 110 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 40 info
- Scan time
- 19.9 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 28 of 29 warn and critical signals; 29 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-18 05:41
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
likely benign A GitHub URL in a markdown documentation file, flagged as a base64-like blob.
Reasoning
The flagged 'base64-like blob' is a long GitHub URL path with a commit hash inside a markdown FAQ. Raw pattern matches on URL characters are a known false-positive shape, and there is no decoding or execution.
-
=likely benign The standard 32-byte PDF encryption padding constant assigned to _PADDING.Reasoning
The 32-byte sequence 28 BF 4E 5E 4E 75 8A 41 ... is the standard PDF encryption padding string defined by the PDF specification. It is a constant used in RC4/AES key derivation in a PDF library, so the binary shape is expected.
-
=likely benign Hex escapes of the PDF encryption padding constant.Reasoning
This raw hex-escape finding covers the same well-known PDF padding constant. It is a fixed cryptographic constant, not an obfuscated payload.
-
b b )likely benign Second half of the PDF encryption padding constant.Reasoning
This is the second half of the same PDF padding constant, flagged by the raw pass. It is a standard specification value.
-
):likely benign Looks up a visitor parameter by name through locals() to emit a warning.Reasoning
locals() is used to check whether a named visitor argument was passed in order to warn that it is ignored in layout mode. This is a local-variable lookup for a legitimate parameter check, with no dynamic execution or hidden payload.
-
= = =likely benign Bounded zlib decompression of PDF stream data.Reasoning
This is standard FlateDecode decompression of PDF stream data, bounded by max_length from configuration. It is ordinary PDF parsing and decompression, not a runtime-embedded payload.
-
inlikely benign A concatenated bytes lookup table used in inline image parsing.Reasoning
The bytes literal lists byte values in a tuple used for inline image parsing or marker classification. The content is a fixed table of byte values for image format handling, not an executable payload.
-
b b ): =likely benign Continuation of a byte-value lookup table in inline image parsing.Reasoning
This raw hex finding is the continuation of the same byte lookup table in the inline image parser. It is a legitimate constant table.
-
October 14, 1998 Heres to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes. The ones who see things differently. Theyre not fond of rules. Andlikely benign Typographic fi ligature in the word 'misfits' within a quote fixture.Reasoning
The 'fi' in 'misfits' is the Unicode fi ligature (U+FB01), which typesetting and PDF text commonly produce. It is ordinary prose in a text test fixture.
-
The round pegs in the square holes. The ones who see things differently. Theyre not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them.likely benign Typographic ff ligature in the word 'differently' within a quote fixture.Reasoning
The 'ff' in 'differently' is the Unicode ff ligature (U+FB00), a common artifact of typeset text. It is not a homoglyph attack.
-
Heres to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes. The ones who see things differently. Theyre not fond of rules. Andlikely benign Typographic fi ligature in a layout test fixture.Reasoning
This is the same fi ligature in 'misfits' in a layout test fixture of the same quote. It is ordinary text.
-
The round pegs in the square holes. The ones who see things differently. Theyre not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them.likely benign Typographic ff ligature in a layout test fixture.Reasoning
This is the same ff ligature in 'differently' in a layout test fixture. It is ordinary typeset text.
-
info
warn→ info by reviewunicode-mixed-scriptresources/crazyones_layout_vertical_space_font_height_weight.txt:4:34Heres to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes.likely benign Typographic fi ligature in a font-variant text fixture.Reasoning
This fi ligature in 'misfits' appears in another text layout fixture. It is ordinary typeset text.
-
info
warn→ info by reviewunicode-mixed-scriptresources/crazyones_layout_vertical_space_font_height_weight.txt:7:28The ones who see things differently. Theyre not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them.likely benign Typographic ff ligature in a font-variant text fixture.Reasoning
This ff ligature in 'differently' appears in another text layout fixture. It is ordinary typeset text.
-
ffd8ffe000104a46494600010100000100010000ffdb0043000302020302020303030304030304050805050404050a070706080c0a0c0c0b0a0b0b0d0e12100d0e110e0b0b1016101113141515150c0f171816141812141514ffdb00430103040405040509050509140d0b0d1414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414ffc2likely benign Long hex dump of JPEG header bytes stored in a text fixture.Reasoning
A single very long line of hex-encoded JPEG header bytes in a text resource file. This is test data in a resource file, typical of a PDF library's fixtures; no execution or concealment.
-
This is a sample document with two columns filled molestie vitae, placerat a, molestie nec, leo. Maece- with Lorem Ipsum text. nas lacinia. Nam ipsum ligula, eleifend at, accumsandismissed Typographic fi ligature in lorem ipsum sample text.Reasoning
The 'fi' is a standard typographic ligature (U+FB01) common in text from PDFs or word processors; it is in lorem ipsum sample text, not an identifier used in code.
-
= . = .. # Check the backwards-compatible substitution works when calling from pypdflikely benign Test helper inspects its caller's frame name to verify compatibility behavior.Reasoning
Test code for a PDF library uses inspect.currentframe() to check the caller name for backwards-compatible substitution. Ordinary introspection in a test, not malicious.
-
= # no error assert in # actually the ϕ and φ seems to be crossed in latex -
assert ==likely benign Binary CCITT image fixture bytes used in a decode test.Reasoning
Bytes literal of a TIFF/CCITT fax test image split across lines, consistent with test fixture data for a PDF filter test. Expected binary shape.
-
=likely benign Duplicate report of the same binary image fixture.Reasoning
Same binary image fixture as the preceding finding, a duplicate report for the same test data. Benign.
-
=likely benign Duplicate report of the same binary image fixture.Reasoning
Same binary image fixture as the preceding finding, a duplicate report for the same test data. Benign.
-
b b )likely benign Continuation of binary image fixture bytes in tests.Reasoning
Continuation of the same binary image test fixture used for PDF filter decoding. Benign.
-
) = b # noqa: E501 # Validation: Is our image data valid?likely benign JBIG2 globals binary fixture in a test.Reasoning
JBIG2 globals binary blob in a test, with a noqa comment for line length. Test fixture data.
-
=likely benign Embedded JPEG inline image fixture in a test.Reasoning
Inline image data with JFIF header bytes embedded in a PDF content stream test. Test fixture.
-
=likely benign Raw pixel fixture bytes for a Flate image test.Reasoning
Raw pixel data for a Flate-compressed image test fixture. Expected binary test data.
-
= =likely benign Test temporarily installs a trace function around a clone call.Reasoning
Test sets a trace function around a clone operation to check garbage-collection or tracing behavior, restoring the previous trace afterward. Ordinary test instrumentation.
-
likely benign Restores the previous trace function after a test.
Reasoning
The finally block restores the previous trace function after the test, paired with the settrace call above. Benign test cleanup.
-
assert . ==likely benign A test fixture embedding a small PNG image as a bytes literal.Reasoning
The bytes literal is a valid PNG file header (\x89PNG signature, IHDR, IDAT, IEND chunks) inside a test asserting image data equality. Heavy \x escapes are the normal way to embed a binary fixture in a Python test. No execution or exfiltration behavior is present.
-
, , ], ) -
, , ], ) -
# Non-hex digits, a marker at the end and a truncated escape are all kept as-is. , , , -
# Non-hex digits, a marker at the end and a truncated escape are all kept as-is. , , , -
, , , # A well-formed escape is still decoded (Adobe stores "my car" this way). -
, , , # A well-formed escape is still decoded (Adobe stores "my car" this way). -
, , # A well-formed escape is still decoded (Adobe stores "my car" this way). , -
, , # A well-formed escape is still decoded (Adobe stores "my car" this way). , -
# A well-formed escape is still decoded (Adobe stores "my car" this way). , ], ) -
=, =, =12, =False, -
= =likely benign A test helper that temporarily installs a call-counting profiler around a function call.Reasoning
The function saves the previous profiler, installs a call-counting profile function, runs the target, and restores it. This is a standard test helper for counting calls. sys.setprofile is not malicious here, and the finding's 'frame introspection' label overstates it.
-
return ,likely benign The finally-block restore of the previous profile function in a test helper.Reasoning
This is the restore step in the finally block that resets the profiler saved earlier. It pairs with the install at line 255 in a clean try/finally pattern, which is legitimate test scaffolding.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&