PyPI / snowflake-connector-python / 5.1.0

snowflake-connector-python 5.1.0

Source: https://github.com/snowflakedb/drivers
Tag scanned: snowflake-connector-python/5.1.0
Directory: python (only this part of the repository was scanned)
Compared with: snowflake-connector-python/5.0.0 (0 signals introduced since)
Files: 441 scanned, 19 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 13 info
Scan time: 8.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 12 of 12 warn and critical signals; 12 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 18:28

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line python/CHANGELOG.md:110:1

line length 514 characters (raw pass, confidence 0.50)

- Changed legacy HTTP error classes so they remain importable from `snowflake.connector.errors`, warn on first use, and are no longer raised: `HttpError`, `InternalServerError`, `ServiceUnavailableError`, `GatewayTimeoutError`, `ForbiddenError`, `RequestTimeoutError`, `BadRequest`, `BadGatewayError`, `MethodNotAllowed`

info ~~warn~~ → info by review dynamic-execution python/README.md:29:1

[embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
# Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# Install Hatch
```
likely benign LLM, confidence 0.85 Documentation shows installing uv via curl piped to sh.
Reasoning
Standard uv installer one-liner in project docs; curl piped to sh is a common, if poor-practice, install instruction from a well-known vendor domain. Not obfuscation or hidden intent.
info ~~warn~~ → info by review frame-introspection python/src/snowflake/connector/_internal/backward_compatibility.py:177:17

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        frame = sys._getframe(2)  # skip: this helper + our direct caller
    except ValueError:
        return True
```
likely benign LLM, confidence 0.90 Connector helper uses sys._getframe to inspect its caller.
Reasoning
sys._getframe(2) used to find the caller for a compatibility helper, with a ValueError guard. Typical library introspection, not malicious.
info ~~warn~~ → info by review dynamic-attribute python/src/snowflake/connector/_internal/errorhandler.py:148:16

reach-by-name through `vars` (ast pass, confidence 0.60)
```
            continue
        attr = vars(cls)[name]
        if getattr(attr, _SIMPLIFIED_ERROR_HANDLING_ATTR, False):
            continue
```
likely benign LLM, confidence 0.88 Reads class attributes via vars() to check a simplified-error-handling marker.
Reasoning
vars(cls)[name] reads class dict to check a marker attribute on error handler methods. Ordinary reflection for a decorator-like flag.
info ~~warn~~ → info by review frame-introspection python/src/snowflake/connector/_internal/logging/core_logger.py:109:17

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # stacklevel counts frames above that method
        frame = sys._getframe(1 + stacklevel)
        self._dispatch(
            py_level,
```
likely benign LLM, confidence 0.90 Logger uses frame introspection to determine caller location for log records.
Reasoning
sys._getframe(1 + stacklevel) used to attach correct source location to log records, a common logging pattern.
info ~~warn~~ → info by review macro-keyword-override python/src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/flatcc/portable/pinline.h:10:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
#undef inline
#define inline __inline
#elif __GNUC__ >= 3 /* GCC 3 or newer */
#define inline __inline
```
likely benign LLM, confidence 0.90 Portability header redefines inline keyword per compiler.
Reasoning
Portable compatibility header from flatcc redefining inline per compiler; this is a well-known, legitimate portability idiom.
info ~~warn~~ → info by review macro-keyword-override python/src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/flatcc/portable/pinline.h:12:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
#elif __GNUC__ >= 3 /* GCC 3 or newer */
#define inline __inline
#else /* Unknown or ancient */
#define inline
```
likely benign LLM, confidence 0.90 Portability header defines inline for compilers lacking support.
Reasoning
Same flatcc portability header, compiler-conditional inline definition; benign.
info ~~warn~~ → info by review frame-introspection python/src/snowflake/connector/_internal/utils.py:21:16

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        return inspect.stack(context=0)[-1].filename
    except Exception:
        return None
```
likely benign LLM, confidence 0.90 Utility retrieves caller filename via inspect.stack.
Reasoning
inspect.stack(context=0) to get calling module filename for logging or diagnostics; ordinary usage.
info ~~warn~~ → info by review dynamic-execution python/tests/README.md:16:1

[embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
# Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# Install Hatch
```
likely benign LLM, confidence 0.85 Test README shows installing uv via curl piped to sh.
Reasoning
Same uv installer curl-to-sh instruction in test docs; common install guidance from a known vendor.
info ~~critical~~ → info by review dynamic-execution python/tests/README.md:42:1

[embedded bash] `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)
```
# Auto-detect path:
eval $(python scripts/detect_core_path.py --export)

# Or set manually:
```
likely benign LLM, confidence 0.70 Test README evals output of a local detect_core_path.py script.
Reasoning
eval of a command substitution running a repo-local helper script to export a core path. Poor practice and executes local code, but it is a documented developer setup step in a test README, not a hidden dropper.
info ~~warn~~ → info by review decoder-decompress-payload python/tests/e2e/put_get/test_put_get_file_stream.py:162:20

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            assert downloaded.exists(), f"missing downloaded file: {downloaded}"
            assert gzip.decompress(downloaded.read_bytes()) == payload, (
                "decompressed content does not match the original payload"
            )
```
likely benign LLM, confidence 0.90 Test asserts downloaded gzip content matches expected payload.
Reasoning
gzip.decompress used in a test to verify a downloaded file matches the original payload; test assertion, not runtime payload execution.
info ~~warn~~ → info by review decoder-decompress-payload python/tests/integ/telemetry/_telemetry_helpers.py:46:27

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    try:
        return json.loads(gzip.decompress(raw_body))
    except gzip.BadGzipFile:
        return json.loads(raw_body)
```
likely benign LLM, confidence 0.90 Telemetry test helper decompresses gzip request bodies with fallback.
Reasoning
Helper decodes possibly gzipped telemetry request bodies, falling back to raw JSON on BadGzipFile. Ordinary HTTP body handling in tests.
info ~~warn~~ → info by review frame-introspection python/tests/unit/test_core_logger.py:44:33

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
            with patch(_SEND, return_value=1):
                expected_line = inspect.currentframe().f_lineno + 1
                logger.info("early import message")
```
likely benign LLM, confidence 0.90 Unit test uses currentframe to compute expected line number for a log assertion.
Reasoning
inspect.currentframe().f_lineno used in a unit test to compute an expected log line number. Benign test technique.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/snowflakedb/drivers drivers && cd drivers
git checkout snowflake-connector-python/5.1.0
disclude scan --severity info --diff snowflake-connector-python/5.0.0 python