PyPI / urllib3 / 2.8.0

urllib3 2.8.0

Source

https://github.com/urllib3/urllib3

Tag scanned

2.8.0

Compared with

2.7.0 (0 signals introduced since)

Files

129 scanned, 24 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:08

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review decoder-decompress-payload src/urllib3/response.py:81:21

   file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

           self._unfed_data = b""
           self._obj = zlib.decompressobj()
   
       def decompress(self, data: bytes, max_length: int = -1) -> bytes:

   likely benign LLM, confidence 0.97 Legitimate zlib decompressobj wrapper used for HTTP response decoding in urllib3.

   Reasoning

   This is urllib3's standard streaming decompressor wrapper around zlib.decompressobj, handling HTTP Content-Encoding responses. Calling decompress on response bytes is the library's core function, not a hidden payload.

2. info warn → info by review encoding-base64 test/test_response.py:194:1

   base64-like blob (620 bytes over 9 lines, compression ratio 0.80) (raw pass, confidence 0.60)

       b"""\
   eJwFweuaoQAAANDfineQhiKLUiaiCzvuTEmNNlJGiL5QhnGpZ99z8luQfe1AHoMioB+QSWHQu/L+
   lzd7W5CipqYmeVTBjdgSATdg4l4Z2zhikbuF+EKn69Q0DTpdmNJz8S33odfJoVEexw/l2SS9nFdi
   pis7KOwXzfSqarSo9uJYgbDGrs1VNnQpT9f8zAorhYCEZronZQF9DuDFfNK3Hecc+WHLnZLQptwk

   likely benign LLM, confidence 0.95 Base64-encoded compressed test fixture in urllib3's response tests.

   Reasoning

   This is a base64-like literal inside a test file, consistent with a fixture holding a compressed HTTP response body (the 'eJ' zlib header is typical). It is test data for decoder tests, and the raw pass has a high false-positive rate for such blobs.

3. info warn → info by review decoder-decompress-payload test/test_response.py:761:19

   file imports decoder module(s) gzip, zlib, base64 and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

           assert r._decoder is not None  # for mypy
           decoded = r._decoder.decompress(compressed_data, max_length=0)
           if name == "br":
               # It's known that some Brotli libraries do not respect

   likely benign LLM, confidence 0.95 Test calling the internal content decoder's decompress method for several encodings.

   Reasoning

   The test exercises the internal decoder's decompress with max_length=0 across gzip, deflate and brotli encodings, which is a unit test of urllib3 decoding behavior. No execution or exfiltration is present.

4. info warn → info by review decoder-decompress-payload test/with_dummyserver/test_poolmanager.py:720:16

   file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

           assert r.status == 200
           assert gzip.decompress(r.data) == b"hello, world!"
   
           r = request(

   likely benign LLM, confidence 0.97 Test asserting gzip-decompressed response body from a local dummy server.

   Reasoning

   gzip.decompress is used to verify the body of a response from the local dummy test server equals an expected string. This is ordinary test assertion code.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/urllib3/urllib3 urllib3 && cd urllib3
git checkout 2.8.0
disclude scan --severity info --diff 2.7.0 .