sortedcontainers 2.4.0

Source: https://github.com/grantjenks/python-sortedcontainers
Tag scanned: v2.4.0
Compared with: v2.3.0 (0 signals introduced since)
Files: 60 scanned, 197 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 22 info
Scan time: 17.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 22 of 22 warn and critical signals; 22 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:35

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:7:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare > tests/results_sortedlist.txt" | bash
python -m tests.benchmark_plot tests/results_sortedlist.txt SortedList --save
```
likely benign LLM, confidence 0.90 Echoes a fixed benchmark command into bash in a project test script.
Reasoning
The piped text is a fixed string literal that activates a virtualenv and runs a benchmark module writing to a results file. No external or untrusted input reaches bash. The echo-into-bash pattern is unusual but harmless here, and the AST rule is firing on the structure alone.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:10:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare > tests/results_sorteddict.txt" | bash
python -m tests.benchmark_plot tests/results_sorteddict.txt SortedDict --save
```
likely benign LLM, confidence 0.90 Pipes a static SortedDict benchmark command into bash.
Reasoning
Same fixed-literal pipeline into bash, invoking a SortedDict benchmark module. Nothing dynamic or attacker-controlled is interpolated, so this is a benign benchmark driver.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:13:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare > tests/results_sortedset.txt" | bash
python -m tests.benchmark_plot tests/results_sortedset.txt SortedSet --save
```
likely benign LLM, confidence 0.90 Pipes a static SortedSet benchmark command into bash.
Reasoning
A fixed string containing a benchmark invocation is piped to bash. It is a plain test harness step with no encoding, obfuscation, or remote fetch.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:19:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _Py37 >> tests/results_runtime_sortedlist.txt" | bash
echo ". env27/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _Py27 >> tests/results_runtime_sortedlist.txt" | bash
```
likely benign LLM, confidence 0.90 Runs static Python 3.7 and 2.7 SortedList benchmark commands via bash.
Reasoning
Two fixed echo strings with Python 3.7 and 2.7 benchmark commands are piped to bash, appending to a results file. The content is static and matches the file's purpose as a benchmark runner.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:20:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _Py27 >> tests/results_runtime_sortedlist.txt" | bash
echo ". env27/bin/activate && pypy -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _PyPy >> tests/results_runtime_sortedlist.txt" | bash
```
likely benign LLM, confidence 0.90 Runs static Python 2.7 and PyPy SortedList benchmark commands via bash.
Reasoning
Fixed literal commands activating a venv and running the SortedList benchmark under Python 2.7 and PyPy. Nothing is fetched or decoded, so this is ordinary build-tooling behavior.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:21:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && pypy -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _PyPy >> tests/results_runtime_sortedlist.txt" | bash
python -m tests.benchmark_plot tests/results_runtime_sortedlist.txt SortedList --suffix _runtime --save
```
likely benign LLM, confidence 0.90 Runs a static PyPy benchmark and then invokes the plot module.
Reasoning
The pipeline is a static PyPy benchmark invocation followed by a plotting command. It is a repeated, legitimate benchmarking pattern with no sensitive or dynamic content.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:25:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _Py37 >> tests/results_runtime_sorteddict.txt" | bash
echo ". env27/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _Py27 >> tests/results_runtime_sorteddict.txt" | bash
```
likely benign LLM, confidence 0.90 Runs static Python 3.7 and 2.7 SortedDict benchmark commands via bash.
Reasoning
Static SortedDict benchmark commands for Python 3.7 and 2.7 are piped to bash. The content is fully literal and consistent with the rest of the benchmark script.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:26:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _Py27 >> tests/results_runtime_sorteddict.txt" | bash
echo ". env27/bin/activate && pypy -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _PyPy >> tests/results_runtime_sorteddict.txt" | bash
```
likely benign LLM, confidence 0.90 Runs static Python 2.7 and PyPy SortedDict benchmark commands via bash.
Reasoning
Fixed-string Python 2.7 and PyPy SortedDict benchmark commands piped to bash. No untrusted input or encoded payload is present.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:27:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && pypy -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _PyPy >> tests/results_runtime_sorteddict.txt" | bash
python -m tests.benchmark_plot tests/results_runtime_sorteddict.txt SortedDict --suffix _runtime --save
```
likely benign LLM, confidence 0.90 Runs a static PyPy SortedDict benchmark and then plots results.
Reasoning
A static PyPy SortedDict benchmark pipeline followed by a plotting call. It is routine benchmark orchestration with no malicious indicators.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:31:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _Py37 >> tests/results_runtime_sortedset.txt" | bash
echo ". env27/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _Py27 >> tests/results_runtime_sortedset.txt" | bash
```
likely benign LLM, confidence 0.90 Runs static Python 3.7 and 2.7 SortedSet benchmark commands via bash.
Reasoning
Static SortedSet benchmark commands for Python 3.7 and 2.7 are piped to bash and appended to results files. This is a benign test-harness pattern with literal content.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:32:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _Py27 >> tests/results_runtime_sortedset.txt" | bash
echo ". env27/bin/activate && pypy -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _PyPy >> tests/results_runtime_sortedset.txt" | bash
```
likely benign LLM, confidence 0.90 Echoes a static command to run a SortedSet benchmark under Python 2.7 and PyPy, piped into bash.
Reasoning
The piped text is a fixed string literal written by the script author, not attacker-controlled or fetched data. It activates a virtualenv and runs a benchmark module, so the bash pipe is an unusual but ordinary way to drive a benchmark run.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:33:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && pypy -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _PyPy >> tests/results_runtime_sortedset.txt" | bash
python -m tests.benchmark_plot tests/results_runtime_sortedset.txt SortedSet --suffix _runtime --save
```
likely benign LLM, confidence 0.90 Echoes a static PyPy benchmark command piped into bash, followed by a plotting command.
Reasoning
The piped content is a hardcoded static command string for a PyPy benchmark run, followed by a plot step. No external input or encoding is involved, so this is a benign build/test script pattern.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:39:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
rm tests/results_load_sortedlist.txt
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _100 --load 100 --no-limit >> tests/results_load_sortedlist.txt" | bash
```
likely benign LLM, confidence 0.90 Removes a previous results file and pipes a static SortedList load benchmark command into bash.
Reasoning
The echoed string is a fixed benchmark invocation with constant arguments. The pipe to bash is a stylistic choice in a test script and does not decode or fetch anything.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:40:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _1000 --load 1000 --no-limit >> tests/results_load_sortedlist.txt" | bash
```
likely benign LLM, confidence 0.90 Pipes a static SortedList benchmark command with load 1000 into bash.
Reasoning
The piped command is a static literal with fixed load parameters writing to a results file. Nothing in it is dynamic or sourced from outside the repository.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:41:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _10000 --load 10000 --no-limit >> tests/results_load_sortedlist.txt" | bash
python -m tests.benchmark_plot tests/results_load_sortedlist.txt SortedList --suffix _load --save
```
likely benign LLM, confidence 0.90 Pipes a static SortedList benchmark command with load 10000 into bash, then plots results.
Reasoning
This is a hardcoded benchmark command with a fixed load size, piped to bash and followed by a plot step. It is benign benchmark tooling.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:45:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
rm tests/results_load_sorteddict.txt
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _100 --load 100 --no-limit >> tests/results_load_sorteddict.txt" | bash
```
likely benign LLM, confidence 0.90 Removes old SortedDict results and pipes a static load benchmark command into bash.
Reasoning
The piped text is a constant benchmark command for SortedDict with fixed arguments. Piping into bash here is an unnecessary indirection but not malicious.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:46:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _1000 --load 1000 --no-limit >> tests/results_load_sorteddict.txt" | bash
```
likely benign LLM, confidence 0.90 Pipes a static SortedDict benchmark command with load 1000 into bash.
Reasoning
Static literal benchmark command with fixed parameters, executed via a pipe to bash in a test script. No decoding or remote content is involved.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:47:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _10000 --load 10000 --no-limit >> tests/results_load_sorteddict.txt" | bash
python -m tests.benchmark_plot tests/results_load_sorteddict.txt SortedDict --suffix _load --save
```
likely benign LLM, confidence 0.90 Pipes a static SortedDict benchmark command with load 10000 into bash, then plots results.
Reasoning
Constant benchmark invocation piped to bash, followed by a plotting step. The content is fully visible and fixed, consistent with a developer benchmark script.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:51:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
rm tests/results_load_sortedset.txt
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _100 --load 100 --no-limit >> tests/results_load_sortedset.txt" | bash
```
likely benign LLM, confidence 0.90 Removes old SortedSet load results and pipes a static benchmark command into bash.
Reasoning
Static SortedSet load benchmark command with fixed arguments, piped into bash. Consistent with the other benchmark lines in the same script.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:52:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _1000 --load 1000 --no-limit >> tests/results_load_sortedset.txt" | bash
```
likely benign LLM, confidence 0.90 Pipes a static SortedSet benchmark command with load 1000 into bash.
Reasoning
A constant benchmark command with fixed load parameters is piped to bash. No untrusted input or obfuscation is present.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:53:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _10000 --load 10000 --no-limit >> tests/results_load_sortedset.txt" | bash
python -m tests.benchmark_plot tests/results_load_sortedset.txt SortedSet --suffix _load --save
```
likely benign LLM, confidence 0.90 Pipes a static SortedSet benchmark command with load 10000 into bash, then plots results.
Reasoning
Hardcoded benchmark command piped to bash, followed by a plot invocation. The pattern is unusual style but the content is entirely static and benign.
info ~~warn~~ → info by review dynamic-execution tests/stress.sh:17:17

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
            for i in $(seq 1 $PARALLEL); do (
                echo ". env$runtime/bin/activate && python -m tests.test_stress_$name $ITER $OFFSET$runtime$j$i >> output.txt 2>&1" | tee -a output.txt | bash
            ) & done
            wait
```
likely benign LLM, confidence 0.90 A stress-test shell script echoes a command that activates a virtualenv and runs a Python test module, piping it into bash in parallel.
Reasoning
The pipeline pipes a locally constructed command string (sourcing a virtualenv and running a Python stress test module with loop variables) into bash. The data is built from the script's own variables, not fetched from a network or decoded from an encoded blob, and the file is a test harness. This is an unusual but benign way of launching parallel test runs, with tee logging the same command to output.txt.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/grantjenks/python-sortedcontainers python-sortedcontainers && cd python-sortedcontainers
git checkout v2.4.0
disclude scan --severity info --diff v2.3.0 .