s3transfer 0.19.3

Source: https://github.com/boto/s3transfer
Tag scanned: 0.19.3
Compared with: 0.19.2 (0 signals introduced since)
Files: 75 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 2 critical · 0 warn · 2 info
Scan time: 6.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 00:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

critical dynamic-execution scripts/performance/benchmark:62:12

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
def run_script(args):
    return subprocess.Popen(args.script, shell=True)
```
likely benign LLM, confidence 0.60 Helper that runs a user-specified script through the shell for benchmarking.
Reasoning
run_script passes args.script, a command-line argument, straight to a shell. That is a command-injection pattern, but in a benchmark utility the script path is user-supplied by design. There is no encoding, hiding, or remote fetch, so this looks like a poorly guarded developer tool rather than malware.
critical dynamic-execution scripts/stress/timeout:66:12

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
def run_script(args):
    return subprocess.Popen(args.script, shell=True)
```
likely benign LLM, confidence 0.60 Helper that runs a user-specified script through the shell for stress testing.
Reasoning
This snippet is identical to the benchmark helper. It runs a CLI-provided script with shell=True, which is an injection risk but matches a developer test-runner's expected behaviour. Nothing in the snippet shows concealment or a dropper.
info ~~warn~~ → info by review dynamic-execution scripts/new-change:123:13

`subprocess.Popen` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        editor = env.get('VISUAL', env.get('EDITOR', 'vim'))
        p = subprocess.Popen(f'{editor} {f.name}', shell=True)
        p.communicate()
        with open(f.name) as f:
```
likely benign LLM, confidence 0.80 Launches the user's editor on a temporary file via a shell command.
Reasoning
The shell=True call builds its command from the user's EDITOR or VISUAL environment variable and a temp file name. That is a common, if unsafe, way to launch an editor, and nothing in the snippet is obfuscated or hidden. Injection risk is limited to the user's own environment.
info ~~warn~~ → info by review encoding-base64 tests/unit/test_crt.py:183:22

base64-like blob (76 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
                    'x-amz-id-2',
                    'xDbgdKdvYZTjgpOTzm7yNP2JPrOQl+eaQvUkFdOjdJoWkIC643fgHxdsHpUKvVAfjKf5F6otEYA=',
                ),
                ('Content-Type', 'application/xml'),
```
dismissed LLM, confidence 0.90 Base64-like S3 request ID string used as a test fixture header.
Reasoning
The 76-byte base64 string is the x-amz-id-2 header value in a unit test fixture for S3-style responses. Random-looking base64 is expected for such identifiers, and the raw pass has a high false-positive rate on this kind of data.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/boto/s3transfer s3transfer && cd s3transfer
git checkout 0.19.3
disclude scan --severity info --diff 0.19.2 .