disclude.ioPyPI / smart-open / 8.0.4
smart-open 8.0.4
- Source
- https://github.com/piskvorky/smart_open
- Tag scanned
v8.0.4- Compared with
v8.0.3(0 signals introduced since)- Files
- 83 scanned, 14 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 46 info
- Scan time
- 7.6 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 12 of 12 warn and critical signals; 12 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-18 21:40
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
-likely benign A changelog bullet begins with a Cyrillic capital С instead of Latin C.Reasoning
The Cyrillic С in 'Сlose' is a homoglyph in a changelog entry prose. Likely a typo or copy-paste artifact from a translator/editor; no malicious effect since it is documentation text, not executable identifier.
-
-likely benign The word 'Сlose' mixes Cyrillic and Latin characters in changelog prose.Reasoning
Same line as the homoglyph finding; mixed script in a markdown changelog word, not an identifier in code. Benign typo-level artifact.
-
>>> ... = >>>likely benign Documentation example decompressing a gzip response with json.loads.Reasoning
This is a doctest-style example in documentation showing smart_open reading a gzip-compressed JSON response from a URL. The decompress call is the documented usage, not a hidden dropper.
-
... , ```likely benign A Russian-language sample text line in the README contains Cyrillic characters.Reasoning
The Cyrillic В in a Russian prose line of the README's embedded example text (Tolstoy-like sample text used in examples). It is natural-language content, not an identifier in code; homoglyph flag is a false positive from the Cyrillic word.
-
likely benign CI helper script runs its positional arguments as a command.
Reasoning
A bash helper that executes its arguments as a command, a standard wrapper pattern in CI helper scripts. The caller controls the command; this is a generic pass-through, not obfuscation.
-
= + = # noqa: RUF001 # Cyrillic fixture = assert == -
= + = # noqa: RUF001 # Cyrillic fixture = assert == -
) : = assert == +likely benign Test helper decompresses gzip content to verify round-trip writes over FTP.Reasoning
Integration test reading a gzip-compressed file it previously wrote and asserting its contents. Legitimate test code.
-
= + = # noqa: RUF001 # Cyrillic fixture = assert == -
= + = # noqa: RUF001 # Cyrillic fixture = assert == -
= assert # noqa: RUF001 # Cyrillic fixture assert -
= assert # noqa: RUF001 # Cyrillic fixture assert -
= assert # noqa: RUF001 # Cyrillic fixture assert -
"""Round-trip a text object via smart_open against S3.""" = # noqa: RUF001 # Cyrillic fixture = assert == -
"""Round-trip a text object via smart_open against S3.""" = # noqa: RUF001 # Cyrillic fixture = assert == -
"""Round-trip a text object with server-side encryption enabled.""" = # noqa: RUF001 # Cyrillic fixture = -
"""Round-trip a text object with server-side encryption enabled.""" = # noqa: RUF001 # Cyrillic fixture = -
"""Ensure that we can wrap a smart_open s3 stream in a BufferedWriter.""" = # noqa: RUF001 # Cyrillic fixture -
likely benign Azurite emulator connection string with its public development account key.
Reasoning
This is the well-known Azurite emulator development connection string account key, split across string literals for line length. Public, non-secret test credential, and the blob is just a base64 key.
-
"""Read gzip.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = -
"""Read gzip.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = -
"""Gzip.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = f -
"""Gzip.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = f -
"""Ensure that we can wrap a smart_open azure stream in a `BufferedWriter`.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = f -
"""Binary iterator.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = f -
"""Nonexisting container.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters -
"""Does appending to a gzip-compressed Azure Blob work via smart_open.open?""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = f -
"""Does appending to a gzip-compressed Azure Blob work via smart_open.open?""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = f -
= # noqa: RUF001 # fixture deliberately uses Cyrillic characters assert == -
"""Read gzip.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = -
"""Read gzip.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = -
"""Binary iterator.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters -
"""Text iterator.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = f -
"""Gzip.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters -
"""Gzip.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters -
"""Ensure that we can wrap a smart_open s3 stream in a `BufferedWriter`.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters -
"""Nonexisting bucket.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters -
"""Ensure that we can wrap a smart_open s3 stream in a `BufferedWriter`.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters -
"""Nonexisting bucket.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters -
"""Test that SinglepartWriter.truncate works.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters -
# noqa: PTH123, SIM115 # test fixture path open """Is SSH line iterator called correctly?"""likely benign Test mock returns a handle to the test module's own file.Reasoning
open(__file__) passed as a mock return value in a test fixture; it is a plain file handle for mocked SSH reading, not payload extraction.
-
"""SetUp.""" = # noqa: RUF001 # fixture deliberately uses Cyrillic characters = = -
=likely benign Test fixture bytes literal containing bz2-compressed sample data.Reasoning
A bz2-compressed test fixture written as a bytes literal, which is the natural way to embed compressed test data in a test suite. Test data, not a dropper.
-
# noqa: PTH123 # test fixture path openlikely benign Test mock returns the test file's own handle for an S3 write assertion.Reasoning
Test mock using open(__file__, 'rb') as a dummy file object for the S3 mock. No execution or extraction of hidden content.
-
# noqa: PTH123 # test fixture path openlikely benign Test mock returns the test file's own handle for an S3 read assertion.Reasoning
Same pattern as the other test mocks: open(__file__) used as a placeholder return value in a mock.patch.
-
assert ==likely benign Test asserts gzip compress/decompress round-trip returns original data.Reasoning
Round-trip gzip compression check in a test asserting data equality. Ordinary test logic.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&