PyPI / snowflake-connector-python / 5.0.0

snowflake-connector-python 5.0.0

Source

https://github.com/snowflakedb/drivers

Tag scanned

snowflake-connector-python/5.0.0

Directory

python (only this part of the repository was scanned)

Compared with

nothing (first release scanned in full)

Files

436 scanned, 19 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 13 info

Scan time

8.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 12 of 12 warn and critical signals; 12 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 07:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info long-line python/CHANGELOG.md:89:1

   line length 514 characters (raw pass, confidence 0.50)

   - Changed legacy HTTP error classes so they remain importable from `snowflake.connector.errors`, warn on first use, and are no longer raised: `HttpError`, `InternalServerError`, `ServiceUnavailableError`, `GatewayTimeoutError`, `ForbiddenError`, `RequestTimeoutError`, `BadRequest`, `BadGatewayError`, `MethodNotAllowed`

2. info warn → info by review dynamic-execution python/README.md:32:1

   [embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)

   # Install uv
   curl -LsSf https://astral.sh/uv/install.sh | sh
   
   # Install Hatch

   likely benign LLM, confidence 0.85 Documentation shows installing uv via curl piped to sh from astral.sh.

   Reasoning

   This is the standard uv installer one-liner in a README install section for a legitimate Snowflake connector project. It is a common but risky install pattern, not hidden obfuscation, and the source is a well-known vendor domain.

3. info warn → info by review frame-introspection python/src/snowflake/connector/_internal/backward_compatibility.py:177:17

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

       try:
           frame = sys._getframe(2)  # skip: this helper + our direct caller
       except ValueError:
           return True

   likely benign LLM, confidence 0.90 Helper reads the caller's frame to decide compatibility behavior.

   Reasoning

   sys._getframe(2) is used with a ValueError fallback to determine the caller context for backward-compatibility logic in a legitimate connector library. Frame introspection here is ordinary.

4. info warn → info by review dynamic-attribute python/src/snowflake/connector/_internal/errorhandler.py:148:16

   reach-by-name through `vars` (ast pass, confidence 0.60)

               continue
           attr = vars(cls)[name]
           if getattr(attr, _SIMPLIFIED_ERROR_HANDLING_ATTR, False):
               continue

   likely benign LLM, confidence 0.90 Reflectively reads a class attribute to check a decorator marker.

   Reasoning

   vars(cls)[name] reads class attributes to check a marker attribute for simplified error handling. This is ordinary reflection in a legitimate library, with no hidden execution or payload.

5. info warn → info by review frame-introspection python/src/snowflake/connector/_internal/logging/core_logger.py:109:17

   `sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)

           # stacklevel counts frames above that method
           frame = sys._getframe(1 + stacklevel)
           self._dispatch(
               py_level,

   likely benign LLM, confidence 0.90 Logger inspects the call stack to set correct source location for log records.

   Reasoning

   sys._getframe(1 + stacklevel) is used to attribute log records to the correct caller line, a standard logging technique. It is benign.

6. info warn → info by review macro-keyword-override python/src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/flatcc/portable/pinline.h:10:1

   `#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)

   #undef inline
   #define inline __inline
   #elif __GNUC__ >= 3 /* GCC 3 or newer */
   #define inline __inline

   likely benign LLM, confidence 0.90 Portability header maps the inline keyword to compiler-specific variants.

   Reasoning

   This is the well-known portable-header pattern in flatcc that redefines inline per compiler to a supported spelling. Vendored portability code, not malicious.

7. info warn → info by review macro-keyword-override python/src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/flatcc/portable/pinline.h:12:1

   `#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)

   #elif __GNUC__ >= 3 /* GCC 3 or newer */
   #define inline __inline
   #else /* Unknown or ancient */
   #define inline

   likely benign LLM, confidence 0.90 Fallback definition of inline for unknown compilers in a vendored portability header.

   Reasoning

   Same vendored flatcc portability header, defining inline as empty or __inline for unknown compilers. Standard and benign.

8. info warn → info by review frame-introspection python/src/snowflake/connector/_internal/utils.py:21:16

   `inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)

       try:
           return inspect.stack(context=0)[-1].filename
       except Exception:
           return None

   likely benign LLM, confidence 0.90 Utility returns the filename of the outermost stack frame.

   Reasoning

   inspect.stack(context=0)[-1].filename retrieves the outermost filename for context, with exception handling. This is ordinary introspection in a library utility.

9. info warn → info by review dynamic-execution python/tests/README.md:16:1

   [embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)

   # Install uv
   curl -LsSf https://astral.sh/uv/install.sh | sh
   
   # Install Hatch

   likely benign LLM, confidence 0.85 Test README shows installing uv via curl piped to sh.

   Reasoning

   Same uv install one-liner as the root README, in test documentation. Common pattern, not hidden obfuscation.

10. info critical → info by review dynamic-execution python/tests/README.md:42:1

    [embedded bash] `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    # Auto-detect path:
    eval $(python scripts/detect_core_path.py --export)
    
    # Or set manually:

    likely benign LLM, confidence 0.80 Test docs suggest eval of a repo script's output to auto-detect the core path.

    Reasoning

    The eval of a Python helper's output sets the core path in test docs. It is a shell-level eval of a dynamic expression, which is risky practice, but the helper is a repo script and the context is a developer instruction. Severity critical is overstated for a local test setup.

11. info warn → info by review decoder-decompress-payload python/tests/e2e/put_get/test_put_get_file_stream.py:162:20

    file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

                assert downloaded.exists(), f"missing downloaded file: {downloaded}"
                assert gzip.decompress(downloaded.read_bytes()) == payload, (
                    "decompressed content does not match the original payload"
                )

    likely benign LLM, confidence 0.90 Test decompresses a downloaded file to compare with the original payload.

    Reasoning

    gzip.decompress is used in a test to verify round-tripped file content against the expected payload. It is test assertion logic, not a runtime payload dropper.

12. info warn → info by review decoder-decompress-payload python/tests/integ/telemetry/_telemetry_helpers.py:46:27

    file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

        try:
            return json.loads(gzip.decompress(raw_body))
        except gzip.BadGzipFile:
            return json.loads(raw_body)

    likely benign LLM, confidence 0.90 Telemetry test helper decodes an optionally gzipped body as JSON.

    Reasoning

    Helper decompresses a gzip request body when present and falls back to raw JSON otherwise. This is ordinary telemetry test parsing.

13. info warn → info by review frame-introspection python/tests/unit/test_core_logger.py:44:33

    `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

                with patch(_SEND, return_value=1):
                    expected_line = inspect.currentframe().f_lineno + 1
                    logger.info("early import message")

    likely benign LLM, confidence 0.90 Unit test reads the current line number to assert log location.

    Reasoning

    inspect.currentframe().f_lineno is used in a unit test to compute the expected log line number. Benign test code.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/snowflakedb/drivers drivers && cd drivers
git checkout snowflake-connector-python/5.0.0
disclude scan --severity info python