requests-oauthlib 2.0.0

Source: https://github.com/requests/requests-oauthlib
Tag scanned: v2.0.0
Compared with: v1.4.1 (0 signals introduced since)
Files: 51 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 4.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 02:01

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution setup.py:27:5

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
if sys.argv[-1] == "publish":
    os.system("python setup.py sdist upload")
    sys.exit()
```
likely benign LLM, confidence 0.85 A setup.py publish shortcut that runs a fixed literal shell command to build and upload a source distribution.
Reasoning
This is the standard publish helper in a setup.py: when the user runs 'python setup.py publish', it runs a fixed literal command to build and upload an sdist. The command is hardcoded with no attacker-controlled input, so it is a common, legitimate release pattern, though os.system with upload is worth a glance.
info ~~warn~~ → info by review encoding-base64 tests/test_oauth1_session.py:23:6

25 rows of base64-like lines, lines 23-47 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)
```
    "-----BEGIN RSA PRIVATE KEY-----\n"
    "MIIEogIBAAKCAQEApF1JaMSN8TEsh4N4O/5SpEAVLivJyLH+Cgl3OQBPGgJkt8cg\n"
    "49oasl+5iJS+VdrILxWM9/JCJyURpUuslX4Eb4eUBtQ0x5BaPa8+S2NLdGTaL7nB\n"
    "OO8o8n0C5FEUU+qlEip79KE8aqOj+OC44VsIquSmOvWIQD26n3fCVlgwoRBD1gzz\n"
```
likely benign LLM, confidence 0.90 A PEM-encoded RSA private key fixture in an OAuth1 test file.
Reasoning
This is a PEM-formatted RSA private key embedded as a string in a test file for OAuth1 signing. The base64 lines are the expected encoding of key material used in test fixtures. The raw pass flags high-entropy base64 structure, which is normal for PEM data. It is a test fixture, not obfuscated code, though a real embedded private key would merit a secret-leak check; it appears to be a test key.
info ~~warn~~ → info by review encoding-base64 tests/test_oauth1_session.py:55:7

base64-like blob (67 bytes, compression ratio 1.16) (raw pass, confidence 0.60)
```
    "Ssp5HUnzH6sNkmVjuE%2FxoJcHJdc23H6GhOs7VJ2LWNdbhKWP%2FMMlTrcoQDn8lz"
    "%2Fb24WsJ6ae1txkUzpFOOlLM8aTdNtGL4OtsubOlRhNqnAFq93FyhXg0KjzUyIZzmMX"
    "9Vx90jTks5QeBGYcLE0Op2iHb2u%2FO%2BEgdwFchgEwE5LgMUyHUI4F3Wglp28yHOAM"
    "jPkI%2FkWMvpxtMrU3Z3KN31WQ%3D%3D"
```
likely benign LLM, confidence 0.90 A percent-encoded base64-like string in an OAuth1 test, probably a signature or test vector.
Reasoning
The snippet is a URL-encoded base64-like string split across concatenated literals, most likely an OAuth signature or test vector with percent-encoded padding (%3D%3D). This is a typical test value in an OAuth test suite, and the raw pass has a high false-positive rate on such strings.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/requests/requests-oauthlib requests-oauthlib && cd requests-oauthlib
git checkout v2.0.0
disclude scan --severity info --diff v1.4.1 .