disclude.ioreportlab 5.1.0
- Artifact scanned
reportlab-5.1.0-py3-none-any.whl- Compared with
reportlab-5.0.1-py3-none-any.whl(8 signals introduced since)- Files
- 166 scanned, 48 skipped (binary, oversized, or unrecognised)
- Signals
- 1 critical · 5 warn · 45 info
- Scan time
- 43.6 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 50 of 50 warn and critical signals; 44 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 11:15
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
likely benign Explicit helper that assigns the given names onto the builtins module.
Reasoning
Setting arbitrary builtins from keyword arguments is a global side effect that affects every importer, which is worth noting. It is an explicit, caller-invoked compatibility helper, not hidden or triggered on import, so the risk is design-level rather than malicious.
-
= =likely benign Loads bundled package metadata (project version) from a marshal file.Reasoning
marshal.loads on a file read from the package's own loader is a deserialization sink in principle, but the data is a bundled metadata file used only to read a version string. Nothing here indicates attacker-supplied input, though the marshal format does deserve a check.
-
= = = =likely benign marshal.load of a local .fastmap CMap cache file.Reasoning
marshal.load can in principle yield code objects, which makes it a sensitive sink. Here it reads reportlab's own .fastmap cache file from a local font directory, which is a shipped data artifact. The risk depends on whether that directory can be written by an attacker, which the snippet does not show.
-
= = = =likely benign marshal.load reading a cached CMap field from a local file.Reasoning
Same marshal.load of consecutive fields from the local .fastmap cache, with no network or external input in the snippet. It is a benign cache-loading pattern, with the same residual marshal risk.
-
= = =likely benign marshal.load reading another cache field from the local .fastmap file.Reasoning
Same cache-file read pattern: marshal.load of a field from reportlab's own .fastmap, followed by f.close(). Benign in context, with the usual caveat about marshal.
-
= = =likely benign marshal.load reading the CMap from the local .fastmap cache.Reasoning
Final marshal.load in the cache-reading sequence, reading the cmap from a local file and then closing it. This is the usual cache-loading behaviour of this font module.
-
info
critical→ info by reviewframe-introspectionreportlab/lib/rl_safe_eval.py:928:13new in this release=likely benign Captures the caller's global namespace to build a safe evaluation environment.Reasoning
Copying the caller's globals via sys._getframe to seed a restricted evaluation namespace is a normal pattern in a safe-eval module. The anti-analysis label is a heuristic artifact of the file also calling eval.
-
info
warn→ info by reviewdynamic-executionreportlab/lib/rl_safe_eval.py:1283:21new in this release= =likely benign Compiles an expression string inside the safe-eval implementation.Reasoning
This file is a restricted-expression evaluator whose purpose is to compile user expressions; compile is its core function and is gated by an AST whitelist elsewhere in the module.
-
info
warn→ info by reviewdynamic-executionreportlab/lib/rl_safe_eval.py:1291:21new in this release= return ,likely benign Compiles a previously parsed and vetted AST inside the safe-eval pipeline.Reasoning
Compiling a checked AST in the safe-eval module is the expected pipeline stage. The non-literal input is the intended use of the library.
-
info
critical→ info by reviewframe-introspectionreportlab/lib/rl_safe_eval.py:1304:21new in this release= = =likely benign Reads the caller frame's globals to determine evaluation context.Reasoning
Reading the calling frame's globals to resolve the module name for the evaluation context is routine. The anti-analysis tag only reflects that the file contains eval.
-
info
warn→ info by reviewdynamic-executionreportlab/lib/rl_safe_eval.py:1336:20new in this releasereturn =likely benign Evaluates compiled expression bytecode in the restricted safe-eval environment.Reasoning
This eval runs bytecode that was produced by the module's own restricted compile path, with a sandboxed builtins mapping; this is the library's designed purpose rather than an injection sink.
-
info
critical→ info by reviewframe-introspectionreportlab/lib/rl_safe_eval.py:1355:16new in this release=None, =, =None): = #print(f'+++++ {os.path.basename(_loc[1])}:{_loc[2]} {expr=}') =likely benign Records the calling location via inspect.stack for the safe-eval environment.Reasoning
inspect.stack() is used only to record the caller location for the environment, with the debugging print commented out. This is ordinary diagnostic code.
-
info
warn→ info by reviewdynamic-executionreportlab/lib/rl_safe_eval.py:1431:12new in this releasereturnlikely benign Evaluates an expression with restricted builtins in a constructed namespace.Reasoning
The eval uses restricted builtins and a constructed namespace inside the safe-eval helper, which is the module's documented function. The risk is inherent to a sandbox and the file shows its restrictions.
-
info
warn→ info by reviewdynamic-attributereportlab/pdfbase/pdfmetrics.py:38:17new in this release= dellikely benign Clears a font or typeface registry entry by looking up module-level cache dictionaries by name.Reasoning
The code iterates over the names '_typefaces' and '_fonts' and deletes entries from the module's own caches via globals(). This is ordinary registry cache management in a PDF library, and the dynamic lookup only touches fixed internal names.
-
= + + \ + \ + \likely benign Extended Code 39 character table written with octal escapes.Reasoning
The octal escapes are the ASCII control-character table for the Code 39 extended character set, a fixed lookup string in a barcode encoder. Sequential octal escapes are the normal way to write that table.
-
+ \ + \likely benign Continuation of the Code 39 extended character table.Reasoning
Continuation of the same ASCII lookup table in the Code 39 extended character set. Nothing is decoded or executed.
-
=likely benign Long inline chart data literal in a sample.Reasoning
A long line holding a literal list of date and float tuples for a chart demo sample. Long data literals are a formatting issue, not obfuscation.
-
= =likely benign Demo runner looks up sample drawing functions by name via globals.Reasoning
The name is a sample identifier from the command line or a fixed list, resolved to a module-level sample function in a demo main block. Reaching functions by name is a common, harmless pattern here.
-
returnlikely benign Sample runner imports sample modules dynamically by name.Reasoning
__import__ receives a module name from the sample runner's own loop over known sample modules, so it is a plugin-style loader in a test/demo script. Non-literal import is flagged, but there is no sign of attacker-controlled input or a payload.
-
-= = + =likely benign UTF-8 byte escapes as internationalized test text.Reasoning
A long string of UTF-8 byte escapes used as multilingual rendering test text in a test-shapes module. Expected for font and encoding tests, and it does not decode to anything executable.
-
: b, : blikely benign Cipher test vector with key, input and output bytes.Reasoning
The bytes literal is a key, plaintext input and expected output test vector for a cipher self-test. Binary-looking literals are normal in cryptographic test data and are not decoded or executed.
-
\x01", : blikely benign Expected ciphertext bytes in a cipher self-test.Reasoning
Continuation of cipher test vectors: the output bytes are the expected ciphertext. This is standard self-test data in a crypto module.
-
= =likely benign Populates module globals and named colour registry from a dict.Reasoning
The loop copies named colour constants from a local dict into module globals and into the named-colour registry. It is a known pattern for populating module namespaces and does not pull in external code.
-
= blikely benign Standard PDF encryption padding constant as bytes.Reasoning
The bytes are the standard 32-byte PDF encryption padding string, a fixed constant defined by the PDF specification. Its shape is expected for this purpose.
-
likely benign Command-line option parsing assigns values via exec on constructed names.
Reasoning
The exec statements build assignments from a hardcoded table of option names and assign command-line values to them. This is poor practice and a code smell, but the target names come from a fixed table, not from attacker-controlled code, and there is no network or process activity. The decoder import alongside exec matches the module's own encryption helpers rather than a dropper.
-
likely benign Exec of a constructed assignment for a command-line option.
Reasoning
Same exec on a constructed assignment string as the previous finding. It is a dynamic-execution smell, but the string is built from a fixed option-name table with a command-line value, so this is most likely benign code.
-
likely benign String-option branch of the same exec-based argument parsing.
Reasoning
Second exec branch of the same option-parsing loop, assigning a string option value from argv through a fixed name table. Unsafe-looking but not evidence of malicious intent.
-
in : =likely benign Selects a random-text word list from module globals by theme name.Reasoning
The globals() lookup indexes a fixed set of module-level word lists by an upper-cased theme name that is checked against a whitelist just above, so it selects data and runs no attacker-controlled code.
-
= = Nonelikely benign Optionally imports compiled accelerator functions from _rl_accel via exec.Reasoning
The exec runs a fixed import statement for names drawn from a hardcoded list of accelerator functions, at module scope. Critical severity is overstated; it is a standard optional C-accelerator loader.
-
=likely benign Test helper that inspects the caller frame to decide output location.Reasoning
A test helper reads the caller's frame locals to check whether it is running as __main__ and to pick an output directory. This is benign test scaffolding.
-
return returnlikely benign Evaluates a pattern-matched literal value with builtins disabled.Reasoning
The eval only runs on values that first matched a restrictive pattern, with __builtins__ set to None. It is a limited literal-parsing helper in test utilities.
-
= . returnlikely benign Detects whether the package was loaded from a zip archive via the caller's loader.Reasoning
Reading the caller's __loader__ to detect a zipimport-based installation is a standard, benign packaging check.
-
= = == and orlikely benign Dynamic __import__ of a library name inside a version-check loop.Reasoning
The snippet is a try/except loop that imports a module by name, reads its __version__ and compares it to an expected value. Checking installed library versions this way is a common, legitimate pattern. The argument is a loop variable over known library names, not attacker-controlled input.
-
= . =likely benign Dynamic __import__ of a module name to collect its file path.Reasoning
The snippet imports a module by name from a list and appends its __file__ to a list. This is a module-location lookup, which is ordinary library behaviour. Nothing here decodes data or reaches the network.
-
= return += 1likely benign Call-stack walk via sys._getframe that hands frame locals to a callback.Reasoning
A loop walks up the call stack with sys._getframe and passes each frame's locals to a callback, stopping on a truthy result. This is a known stack-inspection technique used by libraries for lookups. It is not a hidden payload, though it is a mild code smell.
-
=likely benign Very long generated data line holding glyph width mappings.Reasoning
This is a generated width table for CJK fonts stored as a single very long Python dict literal. Long lines are typical of generated data files, and the content is plain numeric mappings.
-
=likely benign Very long generated data line of glyph widths for a CJK font.Reasoning
Same generated width table as the other long-line finding, a plain dict literal of character widths for a Japanese font. Data-file line length alone is not suspicious.
-
#shift-jis saying 'This is Heisei-Minchou' = =likely benign Shift-JIS sample string written as octal byte escapes, with a comment explaining it.Reasoning
The octal escapes encode Shift-JIS bytes of a sample Japanese string, and the comment explains the purpose. This is test or example text for CJK rendering, not obfuscated code.
-
= = ##def pswidths(text):likely benign Shift-JIS sample message as octal escapes in an example.Reasoning
This is the same documented Shift-JIS sample text as the neighbouring finding, shown with a commented-out helper. It is a literal encoding example with no execution path.
-
=likely benign Resets module-level font dictionaries by name via globals().Reasoning
The loop resets module-level dictionaries by name through globals() using keys from a fixed initial_dicts mapping. This is a normal way to restore font metadata state and does not run attacker-supplied code.
-
# system, print the string to see Kanji =likely benign Shift-JIS demo string as octal escapes in a drawString example.Reasoning
The octal escapes are the Shift-JIS bytes for a sample string used in a PDF demo, with a comment telling the user to view it in a Japanese locale. This is documentation-style example text, not a payload.
-
return # need only one of these, unless we implement parameters laterlikely benign A PDF FlateDecode helper that calls zlib.decompress on stream data.Reasoning
This is a generic decode method wrapping zlib.decompress, the standard FlateDecode filter used when reading PDF streams. Decompressing data is the library's job here, and the snippet shows no hidden payload, execution, or network access.
-
=likely benign Resets module-level registry dictionaries from a saved snapshot.Reasoning
The loop restores known module-level dictionaries from a fixed initial_dicts mapping by clearing and updating them. It is a state reset with no external input or execution, which is typical of test or reset helpers.
-
= returnlikely benign Copies named local variables from an image-handling function into a return dictionary.Reasoning
vars() is used to copy named local variables into an extraReturn dict for keys the caller requested. This is a local-variable readback pattern that does not hide intent or reach external resources.
-
= return Truelikely benign Copies requested local variables into an extraReturn dictionary during image processing.Reasoning
This is the same vars()-based readback of requested local values as in canvas.py, used to populate an extraReturn dict. It is ordinary library code.
-
= .likely benign Reads the caller's 'op' local variable to include it in an unknown-line-command error message.Reasoning
sys._getframe(1) reads the caller's 'op' local to build an error message for an unknown line command. It is unusual and introspective, but it only feeds a ValueError message and has no execution, process, or network behaviour.
-
=likely benign Stores a configuration option as a module-level global, optionally after validation.Reasoning
The _setOpt helper stores a configuration value under a name in globals() after an optional check callback. This is the standard way a configuration module exposes its settings, and the name comes from the library's own option set.
-
= =likely benign Initialises module-level configuration globals from a defaults dictionary during startup.Reasoning
The loop writes default values from _DEFAULTS into module globals and records them in _SAVED, and it appends names to __all__. This is normal startup initialisation of configuration defaults.
-
= =likely benign Filters a configured list of search directories down to those that exist.Reasoning
The code rewrites a path-list configuration global by filtering it with rl_isdir, which keeps only existing directories. This is configuration normalisation with no external execution or payload.
-
= =likely benign Reads the configured directory list to filter it to existing directories.Reasoning
This is the read side of the same directory-list filtering on the configuration global, a finding that is part of the same benign configuration logic.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|