PyPI / requests-oauthlib / 2.0.0

requests-oauthlib 2.0.0

Source

https://github.com/requests/requests-oauthlib

Tag scanned

v2.0.0

Compared with

v1.4.1 (0 signals introduced since)

Files

51 scanned, 8 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

4.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:28

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution setup.py:27:5

   `os.system` called with a literal shell command (ast pass, confidence 0.70)

   if sys.argv[-1] == "publish":
       os.system("python setup.py sdist upload")
       sys.exit()

   likely benign LLM, confidence 0.85 A setup.py helper that runs a hardcoded 'python setup.py sdist upload' command when invoked with the publish argument.

   Reasoning

   This is the classic setup.py publish helper: when the user passes 'publish', it runs a fixed literal shell command to build and upload a source distribution, then exits. The command is hardcoded with no attacker-controlled input, so it is a legitimate developer convenience rather than a dropper. Some risk remains because setup.py runs at install time, but the guard requires an explicit argument that installers do not pass.

2. info warn → info by review encoding-base64 tests/test_oauth1_session.py:23:6

   25 rows of base64-like lines, lines 23-47 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

       "-----BEGIN RSA PRIVATE KEY-----\n"
       "MIIEogIBAAKCAQEApF1JaMSN8TEsh4N4O/5SpEAVLivJyLH+Cgl3OQBPGgJkt8cg\n"
       "49oasl+5iJS+VdrILxWM9/JCJyURpUuslX4Eb4eUBtQ0x5BaPa8+S2NLdGTaL7nB\n"
       "OO8o8n0C5FEUU+qlEip79KE8aqOj+OC44VsIquSmOvWIQD26n3fCVlgwoRBD1gzz\n"

   likely benign LLM, confidence 0.93 A test fixture containing an embedded PEM RSA private key used for OAuth1 signature testing.

   Reasoning

   The lines are a PEM-encoded RSA private key embedded as a string literal in a test file. The base64 structure is expected for key material used in OAuth1 RSA signature tests. This is test fixture data, not obfuscated payload, though it is a committed key-looking blob worth noting.

3. info warn → info by review encoding-base64 tests/test_oauth1_session.py:55:7

   base64-like blob (67 bytes, compression ratio 1.16) (raw pass, confidence 0.60)

       "Ssp5HUnzH6sNkmVjuE%2FxoJcHJdc23H6GhOs7VJ2LWNdbhKWP%2FMMlTrcoQDn8lz"
       "%2Fb24WsJ6ae1txkUzpFOOlLM8aTdNtGL4OtsubOlRhNqnAFq93FyhXg0KjzUyIZzmMX"
       "9Vx90jTks5QeBGYcLE0Op2iHb2u%2FO%2BEgdwFchgEwE5LgMUyHUI4F3Wglp28yHOAM"
       "jPkI%2FkWMvpxtMrU3Z3KN31WQ%3D%3D"

   likely benign LLM, confidence 0.93 A percent-encoded base64-like string constant in an OAuth1 test, likely a sample signature or token value.

   Reasoning

   The snippet is a URL-encoded OAuth-style signature or token string split across concatenated literals in a test file. Percent-encoded base64 characters are typical of OAuth test vectors and signatures. The raw pass flagged it on base64-likeness alone, a known high false-positive pattern, and nothing indicates an encoded payload being decoded or executed.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/requests/requests-oauthlib requests-oauthlib && cd requests-oauthlib
git checkout v2.0.0
disclude scan --severity info --diff v1.4.1 .