sortedcontainers 2.4.0

Source: https://github.com/grantjenks/python-sortedcontainers
Tag scanned: v2.4.0
Compared with: v2.3.0 (0 signals introduced since)
Files: 61 scanned, 196 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 22 info
Scan time: 15.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 22 of 22 warn and critical signals; 22 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 03:07

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:7:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare > tests/results_sortedlist.txt" | bash
python -m tests.benchmark_plot tests/results_sortedlist.txt SortedList --save
```
likely benign LLM, confidence 0.92 Benchmark script that echoes a literal virtualenv activation and benchmark command into bash.
Reasoning
The piped text is a fixed, literal command that activates a local virtualenv and runs a repo benchmark module writing to a results file. Piping echoed commands into bash is an odd style but harmless, and the content is plainly the project's own benchmark workflow.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:10:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare > tests/results_sorteddict.txt" | bash
python -m tests.benchmark_plot tests/results_sorteddict.txt SortedDict --save
```
likely benign LLM, confidence 0.92 Benchmark script running a fixed SortedDict benchmark command through bash.
Reasoning
Same fixed benchmark invocation for SortedDict piped to bash, with no external input, network access, or obfuscation. It matches the legitimate test tooling of the project.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:13:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare > tests/results_sortedset.txt" | bash
python -m tests.benchmark_plot tests/results_sortedset.txt SortedSet --save
```
likely benign LLM, confidence 0.92 Benchmark script running a fixed SortedSet benchmark command through bash.
Reasoning
A literal echo of a local benchmark command piped to bash. The string is constant and contains no decoding or remote fetch, so it is a benign build/benchmark pattern.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:19:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _Py37 >> tests/results_runtime_sortedlist.txt" | bash
echo ". env27/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _Py27 >> tests/results_runtime_sortedlist.txt" | bash
```
likely benign LLM, confidence 0.90 Multi-version runtime benchmark commands for SortedList piped to bash.
Reasoning
Fixed commands for multiple Python versions piped to bash, appending results to a local file. The pattern is unusual but has no untrusted input or malicious payload.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:20:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _Py27 >> tests/results_runtime_sortedlist.txt" | bash
echo ". env27/bin/activate && pypy -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _PyPy >> tests/results_runtime_sortedlist.txt" | bash
```
likely benign LLM, confidence 0.90 Runtime benchmark commands for PyPy and Python 2.7 piped to bash.
Reasoning
Constant benchmark command text for Python 2.7 and PyPy piped to bash. No external data flows in and nothing sensitive is touched.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:21:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && pypy -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _PyPy >> tests/results_runtime_sortedlist.txt" | bash
python -m tests.benchmark_plot tests/results_runtime_sortedlist.txt SortedList --suffix _runtime --save
```
likely benign LLM, confidence 0.91 Piped benchmark invocation followed by a local plot generation step.
Reasoning
The line pipes a literal echoed command to bash, then calls a local plotting module. It is consistent with a benchmark and plotting workflow.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:25:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _Py37 >> tests/results_runtime_sorteddict.txt" | bash
echo ". env27/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _Py27 >> tests/results_runtime_sorteddict.txt" | bash
```
likely benign LLM, confidence 0.92 SortedDict runtime benchmark commands piped to bash.
Reasoning
Fixed SortedDict runtime benchmark commands piped to bash, with output redirected to local result files. Nothing indicates malicious intent.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:26:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _Py27 >> tests/results_runtime_sorteddict.txt" | bash
echo ". env27/bin/activate && pypy -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _PyPy >> tests/results_runtime_sorteddict.txt" | bash
```
likely benign LLM, confidence 0.92 SortedDict benchmark commands for alternate interpreters piped to bash.
Reasoning
Constant benchmark command for Python 2.7 and PyPy piped to bash. This is the same benign test-harness pattern.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:27:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && pypy -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _PyPy >> tests/results_runtime_sorteddict.txt" | bash
python -m tests.benchmark_plot tests/results_runtime_sorteddict.txt SortedDict --suffix _runtime --save
```
likely benign LLM, confidence 0.91 SortedDict runtime benchmark piped to bash, then plotted.
Reasoning
Piped literal benchmark command followed by a local plot call on the results file. The workflow is benign.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:31:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _Py37 >> tests/results_runtime_sortedset.txt" | bash
echo ". env27/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _Py27 >> tests/results_runtime_sortedset.txt" | bash
```
likely benign LLM, confidence 0.92 SortedSet runtime benchmark commands piped to bash.
Reasoning
Fixed SortedSet runtime benchmark commands piped to bash, writing to local results. No untrusted input is involved.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:32:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _Py27 >> tests/results_runtime_sortedset.txt" | bash
echo ". env27/bin/activate && pypy -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _PyPy >> tests/results_runtime_sortedset.txt" | bash
```
likely benign LLM, confidence 0.92 SortedSet benchmark commands for alternate interpreters piped to bash.
Reasoning
Constant benchmark commands for alternate Python interpreters piped to bash, consistent with the project's test harness.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:33:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env27/bin/activate && pypy -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _PyPy >> tests/results_runtime_sortedset.txt" | bash
python -m tests.benchmark_plot tests/results_runtime_sortedset.txt SortedSet --suffix _runtime --save
```
likely benign LLM, confidence 0.91 SortedSet runtime benchmark piped to bash, then plotted.
Reasoning
Piped literal benchmark command followed by a local plotting step over local results. No sign of obfuscation or malicious payload.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:39:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
rm tests/results_load_sortedlist.txt
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _100 --load 100 --no-limit >> tests/results_load_sortedlist.txt" | bash
```
likely benign LLM, confidence 0.93 Hardcoded benchmark command for SortedList is echoed into bash to run a Python benchmark.
Reasoning
The pipeline echoes a fixed, hardcoded benchmark command with literal arguments and pipes it to bash. There is no external or attacker-controlled input, and the same pattern repeats across the benchmark script. This is an odd but harmless way to run a test command in a project's own test suite.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:40:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _1000 --load 1000 --no-limit >> tests/results_load_sortedlist.txt" | bash
```
likely benign LLM, confidence 0.93 Hardcoded SortedList benchmark run with load 1000 is piped to bash.
Reasoning
Same fixed benchmark invocation with literal arguments (--load 1000) piped to bash. No untrusted input is involved, so the dynamic-execution signal is a false positive from a test harness.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:41:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedlist --bare --kind SortedList --suffix _10000 --load 10000 --no-limit >> tests/results_load_sortedlist.txt" | bash
python -m tests.benchmark_plot tests/results_load_sortedlist.txt SortedList --suffix _load --save
```
likely benign LLM, confidence 0.93 Hardcoded SortedList benchmark run with load 10000 is piped to bash, followed by a plotting call.
Reasoning
Fixed benchmark command with literal load parameter 10000 is echoed into bash. The content is static and the file is a project benchmark script, so there is no malicious indicator.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:45:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
rm tests/results_load_sorteddict.txt
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _100 --load 100 --no-limit >> tests/results_load_sorteddict.txt" | bash
```
likely benign LLM, confidence 0.93 Hardcoded SortedDict benchmark invocation is piped to bash.
Reasoning
Static benchmark command for SortedDict echoed into bash with literal arguments. It is part of the project's test tooling and carries no sign of obfuscation or attack.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:46:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _1000 --load 1000 --no-limit >> tests/results_load_sorteddict.txt" | bash
```
likely benign LLM, confidence 0.93 Hardcoded SortedDict benchmark with load 1000 is piped to bash.
Reasoning
Fixed SortedDict benchmark command with literal load values, piped to bash inside a test script. This is a benign, if unusual, test harness pattern.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:47:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sorteddict --bare --kind SortedDict --suffix _10000 --load 10000 --no-limit >> tests/results_load_sorteddict.txt" | bash
python -m tests.benchmark_plot tests/results_load_sorteddict.txt SortedDict --suffix _load --save
```
likely benign LLM, confidence 0.93 Hardcoded SortedDict benchmark with load 10000 is piped to bash, followed by a plot step.
Reasoning
Static command with literal parameters for the SortedDict benchmark, piped to bash. No external input reaches the pipeline, so this is a false positive.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:51:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
rm tests/results_load_sortedset.txt
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _100 --load 100 --no-limit >> tests/results_load_sortedset.txt" | bash
```
likely benign LLM, confidence 0.93 Hardcoded SortedSet benchmark is piped to bash.
Reasoning
Fixed SortedSet benchmark invocation echoed into bash with literal arguments. It is project benchmark tooling with no untrusted input or concealment.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:52:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _1000 --load 1000 --no-limit >> tests/results_load_sortedset.txt" | bash
```
likely benign LLM, confidence 0.93 Hardcoded SortedSet benchmark with load 1000 is piped to bash.
Reasoning
Static SortedSet benchmark command with literal load 1000 piped to bash. Nothing in the snippet is dynamic or attacker-driven.
info ~~warn~~ → info by review dynamic-execution tests/benchmark.sh:53:1

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
echo ". env37/bin/activate && python -m tests.benchmark_sortedset --bare --kind SortedSet --suffix _10000 --load 10000 --no-limit >> tests/results_load_sortedset.txt" | bash
python -m tests.benchmark_plot tests/results_load_sortedset.txt SortedSet --suffix _load --save
```
likely benign LLM, confidence 0.93 Hardcoded SortedSet benchmark with load 10000 is piped to bash, followed by a plot.
Reasoning
Fixed SortedSet benchmark with literal load 10000 piped to bash, followed by a plotting command. This matches ordinary test-harness scripting.
info ~~warn~~ → info by review dynamic-execution tests/stress.sh:17:17

pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
            for i in $(seq 1 $PARALLEL); do (
                echo ". env$runtime/bin/activate && python -m tests.test_stress_$name $ITER $OFFSET$runtime$j$i >> output.txt 2>&1" | tee -a output.txt | bash
            ) & done
            wait
```
likely benign LLM, confidence 0.85 Stress-test loop builds a Python test command from script variables and pipes it to bash in parallel.
Reasoning
The echoed command interpolates shell variables ($runtime, $name, $ITER, $OFFSET, $j, $i) into a string that is piped to bash. Those variables are set by the script's own loop over a parallel count and the test name, not by external input. This is a stress-test driver running its own Python tests, so it is benign but more dynamic than the benchmark lines.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/grantjenks/python-sortedcontainers python-sortedcontainers && cd python-sortedcontainers
git checkout v2.4.0
disclude scan --severity info --diff v2.3.0 .