disclude.iopypdf 6.21.2
- Source
- https://github.com/py-pdf/pypdf
- Tag scanned
6.21.2- Compared with
6.21.1(0 signals introduced since)- Files
- 187 scanned, 110 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 40 info
- Scan time
- 18.3 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 28 of 29 warn and critical signals; 29 demoted to info.
- Disclude version
- 4.1.0
- Scanned (UTC)
- 2026-10-22 09:14
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
dismissed A GitHub URL path in a markdown FAQ was flagged as a base64-like blob.
Reasoning
The base64-like match is a fragment of a GitHub URL path containing a commit hash and directory names, not an encoded payload. Raw pass has high false-positive rate.
-
=likely benign The PDF standard padding constant defined as a bytes literal in the encryption module.Reasoning
The bytes literal is the standard PDF encryption padding string (the 32-byte PDF spec padding constant used in RC4/AES key derivation). Binary-looking escapes are expected for this legitimate cryptographic constant in a PDF library.
-
=likely benign Hex-escaped PDF padding bytes in the encryption module.Reasoning
Hex escapes form the well-known PDF padding constant; this is a fixed spec value, not obfuscated code.
-
b b )likely benign Continuation of the PDF padding constant bytes literal.Reasoning
Continuation line of the same standard PDF padding constant; legitimate spec data.
-
):likely benign Use of locals() to test whether a visitor argument is set in a text extraction function.Reasoning
locals() is used to check whether a keyword argument (visitor) was passed, a common idiom for detecting ignored parameters in layout mode. Not a reach-by-name attack, though it is unusual style.
-
= = =likely benign Size-limited zlib decompression used for PDF Flate filter data.Reasoning
zlib decompressobj with max_length is the standard size-limited FlateDecode implementation for PDF streams. Decompressing data is the library's core purpose, not a hidden payload.
-
inlikely benign Table of byte constants used when parsing inline image data.Reasoning
The bytes literal lists JPEG/marker-like byte values used in inline image filter parsing (checking byte codes against a set). This is a legitimate constant table for PDF image parsing.
-
b b ): =likely benign Continuation of a byte constant table in inline image parsing.Reasoning
Continuation of the same legitimate byte-constant table in the inline image parser.
-
October 14, 1998 Heres to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes. The ones who see things differently. Theyre not fond of rules. Anddismissed Typographic ligature in a quote text test fixture.Reasoning
The 'fi' ligature (U+FB01) in a text fixture is a typographic ligature from the source quote, a test resource for PDF text extraction. Not an identifier attack.
-
The round pegs in the square holes. The ones who see things differently. Theyre not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them.dismissed Typographic ligature in a quote text fixture.Reasoning
The 'ff' ligature (U+FB00) is typographic text in a plain text resource file, consistent with PDF extraction test content.
-
Heres to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes. The ones who see things differently. Theyre not fond of rules. Anddismissed Ligature in a layout test fixture text.Reasoning
Same typographic ligature in a text test fixture for layout extraction; benign.
-
The round pegs in the square holes. The ones who see things differently. Theyre not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them.dismissed Ligature in a layout test fixture text.Reasoning
Same typographic ligature in a layout test fixture; benign.
-
info
warn→ info by reviewunicode-mixed-scriptresources/crazyones_layout_vertical_space_font_height_weight.txt:4:34Heres to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes.dismissed Ligature in a font/layout test fixture text.Reasoning
Typographic ligature in a text test resource; no hidden or malicious intent.
-
info
warn→ info by reviewunicode-mixed-scriptresources/crazyones_layout_vertical_space_font_height_weight.txt:7:28The ones who see things differently. Theyre not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them.dismissed Ligature in a font/layout test fixture text.Reasoning
Typographic ligature in a text test resource; benign.
-
ffd8ffe000104a46494600010100000100010000ffdb0043000302020302020303030304030304050805050404050a070706080c0a0c0c0b0a0b0b0d0e12100d0e110e0b0b1016101113141515150c0f171816141812141514ffdb00430103040405040509050509140d0b0d1414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414ffc2likely benign A hex-encoded JPEG image dumped as a long text line in a resource file.Reasoning
A long single line of hex-encoded JPEG bytes in a resource text file is a test fixture of binary data; no execution or hiding intent is shown.
-
This is a sample document with two columns filled molestie vitae, placerat a, molestie nec, leo. Maece- with Lorem Ipsum text. nas lacinia. Nam ipsum ligula, eleifend at, accumsandismissed A typographic fi-ligature in a lorem ipsum sample document.Reasoning
The ligature character 'fi' in 'filled' is a normal typographic ligature in Lorem Ipsum sample text; a raw-pass unicode anomaly with no code execution context.
-
= . = .. # Check the backwards-compatible substitution works when calling from pypdflikely benign Test helper inspects its caller's frame name to check compatibility behavior.Reasoning
Frame introspection in a test to verify a backward-compatible substitution called from pypdf is a legitimate testing technique in a PDF library.
-
= # no error assert in # actually the ϕ and φ seems to be crossed in latex -
assert ==likely benign Binary CCITT fax image test data as a bytes literal.Reasoning
A TIFF/CCITT binary test fixture expressed as bytes escapes in a PDF library test file; expected for image decoding tests.
-
=likely benign Duplicate binary image test data bytes literal.Reasoning
Same binary image test fixture repeated; legitimate test data for image filter validation.
-
=likely benign Duplicate binary image test data bytes literal.Reasoning
Same binary image test fixture repeated; legitimate test data for image filter validation.
-
b b )likely benign Continuation of binary image test data bytes literal.Reasoning
Continuation of the same binary image test fixture; legitimate for PDF image filter tests.
-
) = b # noqa: E501 # Validation: Is our image data valid?likely benign JBIG2 globals binary test fixture.Reasoning
JBIG2 globals binary fixture used in filter tests; standard test data with no execution path.
-
=likely benign Inline JPEG image bytes used as a PDF test fixture.Reasoning
Embedded JPEG inline image data in a PDF content stream test; legitimate test fixture.
-
=likely benign Raw flate image pixel data constant for tests.Reasoning
Flate-encoded image pixel data constant for a test; legitimate binary fixture.
-
= =likely benign Test wraps cloning with a temporary trace function to inspect behavior.Reasoning
Temporarily setting sys.settrace around a clone operation to check for garbage collection or tracing behavior in tests; a benign testing pattern.
-
likely benign Restores the previous trace function after the test clone operation.
Reasoning
Restoring the previous trace function in a finally block is the cleanup half of the same benign test wrapper.
-
assert . ==likely benign A hardcoded PNG image byte literal used as expected test data in an image test.Reasoning
The bytes literal is a valid PNG file header and IDAT/IEND chunks split across concatenated literals, used as a test fixture for image data. Escapes are the natural way to write binary test data in a test file. No execution or decoding behavior is present.
-
, , ], ) -
, , ], ) -
# Non-hex digits, a marker at the end and a truncated escape are all kept as-is. , , , -
# Non-hex digits, a marker at the end and a truncated escape are all kept as-is. , , , -
, , , # A well-formed escape is still decoded (Adobe stores "my car" this way). -
, , , # A well-formed escape is still decoded (Adobe stores "my car" this way). -
, , # A well-formed escape is still decoded (Adobe stores "my car" this way). , -
, , # A well-formed escape is still decoded (Adobe stores "my car" this way). , -
# A well-formed escape is still decoded (Adobe stores "my car" this way). , ], ) -
=, =, =12, =False, -
= =likely benign A test helper that temporarily installs a call-counting profiler via sys.setprofile.Reasoning
Saving the previous profile function and installing a counting profiler callback is a standard test utility for counting function calls. It is not malicious; the frame-introspection signal fires on the sys.setprofile API itself.
-
return ,likely benign Restores the previous profile hook in a finally block after a call-counting test helper runs.Reasoning
The finally block restores the previous profiler, which is the correct cleanup pattern paired with the installation at line 255. This is test instrumentation with no sign of hidden behavior.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&