starlette 1.9.0

Source: https://github.com/Kludex/starlette
Tag scanned: 1.9.0
Compared with: 1.8.0 (0 signals introduced since)
Files: 125 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 3.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-19 09:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload benchmarks/gzip_benchmark.py:93:16

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        assert isinstance(compressed, bytes)
        assert gzip.decompress(compressed) == self.payload

        assert len(self.tiny_messages) == 2
```
dismissed LLM, confidence 0.95 A benchmark assertion round-trips gzip-compressed test data through gzip.decompress.
Reasoning
The call gzip.decompress(compressed) inside an assertion checks that round-tripping a benchmark payload returns the expected value. The payload is test data generated in the benchmark itself, not an embedded malicious blob executed at runtime. Nothing indicates dropper behavior.
info ~~warn~~ → info by review decoder-decompress-payload tests/middleware/test_gzip.py:162:20

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    assert len(events) == 3
    decompressor = zlib.decompressobj(16 + zlib.MAX_WBITS)
    assert decompressor.decompress(events[1]["body"]) == chunk
    assert decompressor.decompress(events[2]["body"]) == b"tail"
```
dismissed LLM, confidence 0.95 A middleware test decompresses streamed gzip response bodies with zlib to check their contents.
Reasoning
The code uses zlib.decompressobj to verify streamed gzip response chunks in a middleware test, comparing output to expected chunk and tail bytes. This is ordinary test verification of decompression behavior, with no execution of decoded content.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/Kludex/starlette starlette && cd starlette
git checkout 1.9.0
disclude scan --severity info --diff 1.8.0 .