requests-toolbelt 1.0.0

Source: https://github.com/requests/toolbelt
Tag scanned: 1.0.0
Compared with: 0.10.1 (0 signals introduced since)
Files: 83 scanned, 19 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 3.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:38

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution examples/monitor/progress_bar.py:28:43

`open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)
```
        'another_form_field': 'another value',
        'first_file': ('progress_bar.py', open(__file__, 'rb'), 'text/plain'),
        'second_file': ('progress_bar.py', open(__file__, 'rb'),
                        'text/plain'),
```
likely benign LLM, confidence 0.90 Example multipart upload script that attaches its own source file as a form field.
Reasoning
This is an example script in a monitor/upload demo that opens its own file in binary mode to use as a multipart upload field. Reading __file__ here is just providing sample file content for a form upload, not extracting hidden payloads. No decoding or execution follows.
info ~~warn~~ → info by review dynamic-execution examples/monitor/progress_bar.py:29:44

`open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)
```
        'first_file': ('progress_bar.py', open(__file__, 'rb'), 'text/plain'),
        'second_file': ('progress_bar.py', open(__file__, 'rb'),
                        'text/plain'),
        })
```
likely benign LLM, confidence 0.90 Second attachment of the script's own source in the same example upload call.
Reasoning
Same snippet as the sibling finding: the second open(__file__) is simply a second file attachment in the example upload dictionary. No payload extraction or dynamic execution occurs.
info ~~warn~~ → info by review dynamic-execution setup.py:10:5

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
if sys.argv[-1].lower() in ("submit", "publish"):
    os.system("python setup.py bdist_wheel sdist upload")
    sys.exit()
```
likely benign LLM, confidence 0.90 Release helper in setup.py that runs a fixed build-and-upload shell command on publish.
Reasoning
A standard setuptools-style publish helper: when the user passes submit or publish, it runs a fixed literal command to build and upload the package. The command is hardcoded with no external input or encoding, which is typical of project release scripts.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/requests/toolbelt toolbelt && cd toolbelt
git checkout 1.0.0
disclude scan --severity info --diff 0.10.1 .