PyPI / snowflake-connector-python / 5.1.0

snowflake-connector-python 5.1.0

Source: https://github.com/snowflakedb/drivers
Artifact scanned: snowflake_connector_python-5.1.0.tar.gz (sdist · 1.9 MB · SHA-256 2d9eec7fbaa3…)
Compared with: snowflake_connector_python-5.0.0.tar.gz (0 signals introduced since)
Files: 508 scanned, 36 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 28 info
Scan time: 27.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 22 of 22 warn and critical signals; 22 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 10:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution README.md:29:1

[embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
# Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# Install Hatch
```
likely benign LLM, confidence 0.85 Markdown install instructions that pipe the official uv install script from astral.sh into sh.
Reasoning
The curl | sh pipeline is the documented installer for uv in a README install section. Piping a vendor install script to sh is a common, transparent pattern, though it is a supply-chain risk in principle and is worth a note.

info proc-macro-presence error_trace_derive/src/lib.rs:11:1

proc-macro attribute `#[proc_macro_derive]` present (ast pass, confidence 0.95)

/// autoref-based specialization hack.
#[proc_macro_derive(ErrorTrace)]
pub fn error_trace_derive(input: TokenStream) -> TokenStream {
    let input = parse_macro_input!(input as DeriveInput);

info whitespace-anomaly proto_generator/src/generators/rust_generator.rs:13:1

file mixes tab and space indentation (34 tab-indented and 406 space-indented lines) (raw pass, confidence 0.40)
```
impl RustGenerator {
    pub fn new() -> Self {
        Self {}
    }
```

info unicode-mixed-script sf_core/src/apis/database_driver_v1/alter_session_parser.rs:531:72

identifier `ﬁalter` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

    fn test_parse_all_shrinking_char_before_alter_in_bind_value_is_not_a_statement() {
        let results = parse_all_alter_sessions("INSERT INTO t VALUES ('ﬁalter')");
        assert!(
            results.is_empty(),

info ~~warn~~ → info by review encoding-base64 sf_core/src/file_manager/encryption.rs:595:29

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        assert_eq!(sha256, "uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek=");
        assert_eq!(md5, "XrY7u+Ae7tCTyyK7j1rNww==");
    }
```
dismissed LLM, confidence 0.93 Base64-encoded hash constants asserted in a Rust unit test.
Reasoning
The blob is an expected SHA-256/MD5 digest in base64 inside an assert_eq! in a test function. It is a test fixture with no execution path.
info ~~warn~~ → info by review encoding-base64 sf_core/src/file_manager/encryption.rs:884:14

base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
            encoded,
            "B7n4IvUy3F/eYM/3c8GT0Ae5+CL1Mtxf3mDP93PBk9CU9VGsH8Jz102E/GOLKp74"
        );
    }
```
dismissed LLM, confidence 0.93 Base64 expected-output constant in an encryption test assertion.
Reasoning
The 64-byte base64 value is a fixed expected output compared in a test assertion, typical of cryptographic test vectors.
info ~~warn~~ → info by review encoding-base64 sf_core/src/file_manager/gcs_transfer.rs:3868:41

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
        // the skip fires.
        const EMPTY_SHA256_B64: &str = "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";

        let server = MockServer::start().await;
```
dismissed LLM, confidence 0.93 Constant holding the base64 SHA-256 of empty content, used in a mock-server test.
Reasoning
The constant is the base64 SHA-256 of the empty string, used to mock a GCS checksum in a test. It is a well-known value with no obfuscation.
info ~~warn~~ → info by review encoding-base64 sf_core/src/rest/snowflake/workload_identity/aws.rs:1720:173

base64-like blob (74 bytes, compression ratio 0.97) (raw pass, confidence 0.60)
```
            headers["Authorization"],
            "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20240101/us-east-1/sts/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token;x-snowflake-audience, Signature=ce598263c65db61df01e9b76a7226fdfcd6673fc474cbca3cbdc7ae4ccf53bca"
        );
```
dismissed LLM, confidence 0.92 Test assertion containing the AWS documentation example SigV4 Authorization header.
Reasoning
The access key AKIAIOSFODNN7EXAMPLE and the signature are the AWS-documented example credentials, used in a test asserting a SigV4 Authorization header. The 'blob' is a plain header string, not encoded data.
info ~~warn~~ → info by review encoding-base64 sf_core/src/rest/snowflake/workload_identity/aws.rs:1845:152

base64-like blob (74 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
            decoded["headers"]["Authorization"],
            "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20240101/eu-west-1/sts/aws4_request, SignedHeaders=host;x-amz-date;x-snowflake-audience, Signature=7f6f01b5ad72d73b9af0f5e06e3c782fd3d63600efd29a1bcdd28fa379d0fbce"
        );
```
dismissed LLM, confidence 0.92 Test assertion with AWS example SigV4 Authorization header from a decoded fixture.
Reasoning
Same pattern as the sibling finding: AWS documentation example credentials in a test assertion against a decoded header value. No malicious use.

info proc-macro-presence sf_core/tests/common/arrow_deserialize_macro/src/lib.rs:7:1

proc-macro attribute `#[proc_macro_derive]` present (ast pass, confidence 0.95)


#[proc_macro_derive(ArrowDeserialize)]
pub fn arrow_deserialize_derive(input: TokenStream) -> TokenStream {
    // Parse the input tokens into a syntax tree

info ~~warn~~ → info by review frame-introspection src/snowflake/connector/_internal/backward_compatibility.py:177:17

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        frame = sys._getframe(2)  # skip: this helper + our direct caller
    except ValueError:
        return True
```
likely benign LLM, confidence 0.85 Helper that inspects the call stack via sys._getframe to identify its caller.
Reasoning
sys._getframe(2) is used to find the direct caller of a helper for compatibility or warning logic, with a ValueError fallback. This is a common, benign introspection idiom in a connector library.
info ~~warn~~ → info by review dynamic-attribute src/snowflake/connector/_internal/errorhandler.py:148:16

reach-by-name through `vars` (ast pass, confidence 0.60)
```
            continue
        attr = vars(cls)[name]
        if getattr(attr, _SIMPLIFIED_ERROR_HANDLING_ATTR, False):
            continue
```
likely benign LLM, confidence 0.90 Reflective class attribute lookup used to check a simplified-error-handling marker.
Reasoning
vars(cls)[name] reads a class attribute dictionary to check a marker attribute for simplified error handling. This is ordinary reflection on the class's own attributes, with no hidden execution or obfuscated lookup.
info ~~warn~~ → info by review frame-introspection src/snowflake/connector/_internal/logging/core_logger.py:109:17

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # stacklevel counts frames above that method
        frame = sys._getframe(1 + stacklevel)
        self._dispatch(
            py_level,
```
likely benign LLM, confidence 0.88 Logger wrapper that uses sys._getframe with stacklevel to attribute log records to the caller.
Reasoning
sys._getframe(1 + stacklevel) mirrors the stacklevel mechanism of Python's standard logging, to attribute log records to the correct caller. This is a standard logging idiom.
info ~~warn~~ → info by review macro-keyword-override src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/arrow_stream_iterator.cpp:1577:1

`#define __pyx_atomic_int_type int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)
```
#define __PYX_GET_CYTHON_COMPILING_IN_CPYTHON_FREETHREADING() CYTHON_COMPILING_IN_CPYTHON_FREETHREADING
#define __pyx_atomic_int_type int
#define __pyx_nonatomic_int_type int
#if CYTHON_ATOMICS && (defined(__STDC_VERSION__) &&\
```
likely benign LLM, confidence 0.90 Cython-generated C macro defining atomic int type aliases.
Reasoning
This is Cython-generated portability boilerplate. The macro aliases int for atomic and nonatomic type names depending on compiler support, which is standard generated code and not an attack.
info ~~warn~~ → info by review macro-keyword-override src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/arrow_stream_iterator.cpp:1578:1

`#define __pyx_nonatomic_int_type int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)
```
#define __pyx_atomic_int_type int
#define __pyx_nonatomic_int_type int
#if CYTHON_ATOMICS && (defined(__STDC_VERSION__) &&\
                        (__STDC_VERSION__ >= 201112L) &&\
```
likely benign LLM, confidence 0.90 Cython-generated C macro defining the nonatomic int type alias.
Reasoning
Same Cython-generated boilerplate as the adjacent macro definition. The int alias is the intended, standard usage.
info ~~warn~~ → info by review encoding-octal src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/arrow_stream_iterator.cpp:6721:218

17 rows of escape runs, lines 6721-6721 (first: 8 consecutive `\NNN` octal escapes (entropy 2.8 bits/byte)) (raw pass, confidence 0.65)
```
\0353v\314\2301\177\006cG\217\375Sxv\022S\210\033K\361\345\336\367\335\273\367\343{~\351\014\221\027\032\354\307\244\334+\377\323>\312\210\002\317iOhuA\306y\"5\2061\317\350\3137\236\300\324\322Go\231\305\250\255\201\245\222Nb$\177\222\3274\3149\346\3730\356\341iD\007\216\014:mj\311\266\344yr\316\t\244-\216\220*\336}!\3
```
likely benign LLM, confidence 0.72 Generated C source containing a long octal-escaped byte string literal.
Reasoning
A long run of octal escapes in a Cython-generated C source is most likely a serialized constant or binary literal emitted by the code generator, such as embedded module bytecode or a data blob. The snippet alone does not show what the bytes encode, so a small doubt remains.
info ~~warn~~ → info by review embedded-nul-in-string src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/arrow_stream_iterator.cpp:6721:518

string literal contains an embedded NUL followed by 1442 more bytes of source (token pass, confidence 0.85)
```
static const char cstring[] = "x\332}T\277o\323@\024V\245\016-\252D\005\025\254\036\030@\200\263\200\220XPJSQ\t\232&\215@\235\236^\317\317\311\251\366\235{wnc$\244\216\0353v\314\2301\177\006cG\217\375Sxv\022S\210\033K\361\345\336\367\335\273\367\343{~\351\014\221\027\032\354\307\244\334+\377\323>\312\210\002\317iOhuA\3
```
likely benign LLM, confidence 0.70 A large binary-looking C string literal, likely a compressed or serialized data table in vendored generated code.
Reasoning
The literal begins with a zlib-style header and carries binary bytes with embedded NULs. That fits a precompressed or serialized data blob generated into a vendored C++ file, not hand-written code. It is unusual in source, but nothing in the snippet shows it running code. The raw-like binary payload leaves some doubt.
info ~~warn~~ → info by review embedded-nul-in-string src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/arrow_stream_iterator.cpp:6730:95

string literal contains an embedded NUL followed by 1718 more bytes of source (token pass, confidence 0.85)
```
static const char cstring[] = "\377(tree fr\377agment).\377?Failed \377to conve\177rt curr\031\000\377 row, ca\237use: \024\017\033\000s\376\014\020initial\277ize Ar?\000S\376m\000amTable\377Iterator\264h\007\"\010s#\002 i\035\004d\333is/\001en5\001gc\373is\004\003dno d\377efault _\377_reduce_\337_ due\275\001no?n-triv
```
likely benign LLM, confidence 0.80 A Cython-generated string table embedded in the Arrow iterator C++ source, mixing readable names with escaped bytes.
Reasoning
The readable fragments include error text about converting rows and initializing an ArrowTableIterator, plus identifiers like __reduce_, __Pyx_ and PYTHON_TYPE. These are Cython-generated string tables for a Python extension module, a normal build artifact. The embedded NULs and octal escapes are typical of how Cython encodes such tables.
info ~~warn~~ → info by review encoding-octal src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/arrow_stream_iterator.cpp:6730:667

5 rows of escape runs, lines 6730-6730 (first: 6 consecutive `\NNN` octal escapes (entropy 2.6 bits/byte)) (raw pass, confidence 0.65)
```
llU\021\036\027\003many\240U\270U\207\032\360\355J\313\000\215\031\036\013get_\376\214\204\004ed_sche\377maER_FAI\377LED_TO_C\377ONVERT_R\373OW\013\001PYTHO\177N_TYPEI\333A\337faceE\333ARe\277cordBa\372\000S\276A\002__Pyx\001\000D\377ict_Next\377Ref__ann\375o\276\"___fun\315c\004\000_g\317%\021\000ma\375i\374 __modu}l\
```
likely benign LLM, confidence 0.75 Octal escape runs within the same generated Cython string table in the vendored Arrow C++ code.
Reasoning
The raw pass flags runs of octal escapes inside the same generated Cython string table. Such escapes are a standard way to encode binary and non-ASCII bytes in generated code. Raw findings have a higher false-positive rate, and the content is consistent with the table seen in the adjacent finding.
info ~~warn~~ → info by review encoding-octal src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/arrow_stream_iterator.cpp:6739:1540

7 consecutive `\NNN` octal escapes (entropy 2.5 bits/byte) (raw pass, confidence 0.65)
```
f\250A\250Q\330\010\017\210}\230A\330\014\022\220.\240\001\330\020\024\320\0245\260Q\260a\330\020\026\220a\200A\340\010\t\330\014\023\2204\220y\240\004\240B\240h\250a\330\010\017\210}\230A\330\014\022\220.\240\001\330\020\024\320\0245\260Q\260a\330\020\026\220a";
```
likely benign LLM, confidence 0.75 A binary-looking octal-escaped string literal in the vendored generated C++ code.
Reasoning
This is a raw-pass octal escape run in a binary-looking string literal in the same generated file. The bytes look like serialized data or encoded identifiers, and nothing in the snippet executes or decodes them. Without the surrounding code, a generated-table explanation is the most plausible.
info ~~warn~~ → info by review encoding-octal src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/arrow_stream_iterator.cpp:6739:1695

7 consecutive `\NNN` octal escapes (entropy 2.5 bits/byte) (raw pass, confidence 0.65)
```
B\240h\250a\330\010\017\210}\230A\330\014\022\220.\240\001\330\020\024\320\0245\260Q\260a\330\020\026\220a";
```
likely benign LLM, confidence 0.75 The tail of the same octal-escaped binary-looking string literal in the vendored C++ file.
Reasoning
This is the closing part of the same octal-escaped literal flagged by the raw pass. It shows no execution or decoding in the snippet, and it matches the generated-data pattern of its neighbours.
info ~~warn~~ → info by review macro-keyword-override src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/flatcc/portable/pinline.h:10:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
#undef inline
#define inline __inline
#elif __GNUC__ >= 3 /* GCC 3 or newer */
#define inline __inline
```
dismissed LLM, confidence 0.95 A portability header that redefines the inline keyword per compiler, as the flatcc library does.
Reasoning
This is the standard portability shim from the flatcc project. It maps the inline keyword to compiler-specific spellings (__inline for MSVC and older GCC) and defines it empty for unknown compilers. Rebinding inline in a portable header is a known and harmless practice.
info ~~warn~~ → info by review macro-keyword-override src/snowflake/connector/_internal/nanoarrow_cpp/ArrowIterator/flatcc/portable/pinline.h:12:1

`#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)
```
#elif __GNUC__ >= 3 /* GCC 3 or newer */
#define inline __inline
#else /* Unknown or ancient */
#define inline
```
dismissed LLM, confidence 0.95 Another branch of the same flatcc portability shim that defines inline for specific compilers.
Reasoning
This is the same compiler-dispatch block in the flatcc portable header. The define is for the GCC 3+ and fallback branches and has no malicious effect.

info long-line src/snowflake/connector/_internal/protobuf_gen/database_driver_v1_pb2.pyi:534:1

line length 681 characters (raw pass, confidence 0.50)

    _ClearFieldArgType: _TypeAlias = _typing.Literal["_byte_length", b"_byte_length", "_dimension", b"_dimension", "_length", b"_length", "_precision", b"_precision", "_scale", b"_scale", "byte_length", b"byte_length", "column_src_database", b"column_src_database", "column_src_schema", b"column_src_schema", "column_src

info long-line src/snowflake/connector/_internal/protobuf_gen/database_driver_v1_pb2.pyi:645:1

line length 522 characters (raw pass, confidence 0.50)

    _ClearFieldArgType: _TypeAlias = _typing.Literal["_query_result_format", b"_query_result_format", "_row_count", b"_row_count", "_rows_affected", b"_rows_affected", "_sql_state", b"_sql_state", "_statement_type_id", b"_statement_type_id", "_stats", b"_stats", "columns", b"columns", "query_id", b"query_id", "query_re

info ~~warn~~ → info by review frame-introspection src/snowflake/connector/_internal/utils.py:21:16

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        return inspect.stack(context=0)[-1].filename
    except Exception:
        return None
```
likely benign LLM, confidence 0.88 Reads the filename of the outermost call-stack frame, typically for logging or locating the calling script.
Reasoning
inspect.stack(context=0)[-1].filename returns the outermost caller's filename, which is a common way to locate the entry script or for diagnostics and logging. It is slow but not malicious, and the call has no network, process or execution behaviour.
info ~~warn~~ → info by review dynamic-execution tests/README.md:16:1

[embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
# Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# Install Hatch
```
likely benign LLM, confidence 0.85 A developer README instruction that installs uv by piping the official install script to sh.
Reasoning
This is the standard installation instruction for the uv tool from its official install script, shown in a developer's test README. It documents setup for a human to run, and the scanner does not execute markdown. The pipe-to-shell pattern is a known convention, but the source is the well-known vendor URL.
info ~~critical~~ → info by review dynamic-execution tests/README.md:42:1

[embedded bash] `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)
```
# Auto-detect path:
eval $(python scripts/detect_core_path.py --export)

# Or set manually:
```
likely benign LLM, confidence 0.70 A README setup step that evals the export output of a project script to set a core path.
Reasoning
This is a setup instruction in a test README that evals the output of a repository script, scripts/detect_core_path.py, to export a path. Eval of command output is risky in general, but here the script is part of the project and the context is developer setup. Nothing indicates the script is untrusted or that the doc is hiding anything.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o snowflake_connector_python-5.1.0.tar.gz https://files.pythonhosted.org/packages/7a/e4/05727a3af8c240ff6880c0becf729968a34ef691f1bb9f6e0d983bb685e6/snowflake_connector_python-5.1.0.tar.gz
printf '%s  %s\n' 2d9eec7fbaa329b4013b9d67e01e2120fe2878854f6de421cc9d07c620fa270d snowflake_connector_python-5.1.0.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf snowflake_connector_python-5.1.0.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg