s3transfer 0.19.2

Source: https://github.com/boto/s3transfer
Tag scanned: 0.19.2
Compared with: 0.19.1 (0 signals introduced since)
Files: 75 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 2 critical · 0 warn · 2 info
Scan time: 7.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:14

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

critical dynamic-execution scripts/performance/benchmark:62:12

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
def run_script(args):
    return subprocess.Popen(args.script, shell=True)
```
inconclusive LLM, confidence 0.50 A helper that runs a user-supplied script path through the shell.
Reasoning
run_script runs args.script through a shell with shell=True. The input comes from command-line arguments, so the local user controls it, which fits a benchmark runner that executes a user-chosen script. The identical snippet in scripts/stress/timeout suggests copied boilerplate. The critical severity is high for a CLI-argument shell call, but nothing here is obfuscated or hidden, and the intent cannot be settled from this snippet.
critical dynamic-execution scripts/stress/timeout:66:12

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
def run_script(args):
    return subprocess.Popen(args.script, shell=True)
```
inconclusive LLM, confidence 0.50 A helper that runs a user-supplied script path through the shell.
Reasoning
This is the same run_script helper as in scripts/performance/benchmark: args.script is passed to a shell with shell=True. It is a CLI-driven runner, so the local user controls the input. The identical code in two unrelated scripts is worth noting, but the snippet alone does not show malicious intent or a hidden payload.
info ~~warn~~ → info by review dynamic-execution scripts/new-change:123:13

`subprocess.Popen` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        editor = env.get('VISUAL', env.get('EDITOR', 'vim'))
        p = subprocess.Popen(f'{editor} {f.name}', shell=True)
        p.communicate()
        with open(f.name) as f:
```
likely benign LLM, confidence 0.80 Launches the user's configured editor on a temporary file via a shell command.
Reasoning
The command is an f-string built from the user's VISUAL/EDITOR environment variable and a temp file name, which is the standard way to launch an editor from a dev script. shell=True is a needless injection risk, but the input comes from the local user's own environment, not from an attacker or a remote source.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_crt.py:183:22

base64-like blob (76 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
                    'x-amz-id-2',
                    'xDbgdKdvYZTjgpOTzm7yNP2JPrOQl+eaQvUkFdOjdJoWkIC643fgHxdsHpUKvVAfjKf5F6otEYA=',
                ),
                ('Content-Type', 'application/xml'),
```
likely benign LLM, confidence 0.93 An S3 x-amz-id-2 header value stored as a test fixture string.
Reasoning
The raw-pass base64 hit is an opaque string in a test file. It looks like an x-amz-id-2 header value from an S3 response, which is a random-looking, non-executable identifier. It is inside a test fixture of HTTP headers, not decoded or executed, so it is a false positive of the raw pass.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/boto/s3transfer s3transfer && cd s3transfer
git checkout 0.19.2
disclude scan --severity info --diff 0.19.1 .