urllib3 2.8.0

Source: https://github.com/urllib3/urllib3
Tag scanned: 2.8.0
Compared with: 2.7.0 (0 signals introduced since)
Files: 130 scanned, 23 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 5.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 20:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload src/urllib3/response.py:81:21

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        self._unfed_data = b""
        self._obj = zlib.decompressobj()

    def decompress(self, data: bytes, max_length: int = -1) -> bytes:
```
likely benign LLM, confidence 0.95 Creates a zlib decompressor used to decode gzip/deflate HTTP response bodies.
Reasoning
zlib.decompressobj() is the standard streaming decoder for HTTP Content-Encoding in a urllib3 response class. Decompressing response bodies is its core function, not a hidden payload.
info ~~warn~~ → info by review dynamic-import test/contrib/emscripten/templates/pyodide-console.html:97:39

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
        }
        const { loadPyodide } = await import(indexURL + "pyodide.mjs");
        // to facilitate debugging
        globalThis.loadPyodide = loadPyodide;
```
likely benign LLM, confidence 0.85 Test HTML template dynamically imports the Pyodide loader module from indexURL.
Reasoning
The dynamic import loads pyodide.mjs from a configurable indexURL. This is the normal way to bootstrap Pyodide in a browser test template, and the module path is a fixed filename, not attacker-controlled code.
info ~~warn~~ → info by review encoding-base64 test/test_response.py:194:1

base64-like blob (620 bytes over 9 lines, compression ratio 0.80) (raw pass, confidence 0.60)
```
    b"""\
eJwFweuaoQAAANDfineQhiKLUiaiCzvuTEmNNlJGiL5QhnGpZ99z8luQfe1AHoMioB+QSWHQu/L+
lzd7W5CipqYmeVTBjdgSATdg4l4Z2zhikbuF+EKn69Q0DTpdmNJz8S33odfJoVEexw/l2SS9nFdi
pis7KOwXzfSqarSo9uJYgbDGrs1VNnQpT9f8zAorhYCEZronZQF9DuDFfNK3Hecc+WHLnZLQptwk
```
likely benign LLM, confidence 0.85 Base64-encoded zlib-compressed test fixture used for response decoding tests.
Reasoning
The blob starts with the zlib header 'eJw' and sits inside a bytes literal in a test file alongside other compressed-body fixtures. It is a test vector for content decoding, not a dropper, and raw-pass base64 findings have a high false-positive rate.
info ~~warn~~ → info by review decoder-decompress-payload test/test_response.py:761:19

file imports decoder module(s) gzip, zlib, base64 and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        assert r._decoder is not None  # for mypy
        decoded = r._decoder.decompress(compressed_data, max_length=0)
        if name == "br":
            # It's known that some Brotli libraries do not respect
```
likely benign LLM, confidence 0.90 Test calls the response decoder on compressed test data to verify decoding behaviour.
Reasoning
The code calls the response's own decoder on compressed test data with max_length=0 to check decoder behaviour per encoding (gzip, br, etc.). This is a unit test of decompression logic, not runtime payload execution.
info ~~warn~~ → info by review decoder-decompress-payload test/with_dummyserver/test_poolmanager.py:720:16

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        assert r.status == 200
        assert gzip.decompress(r.data) == b"hello, world!"

        r = request(
```
likely benign LLM, confidence 0.92 Integration test decompresses a gzip response and asserts it equals the expected greeting.
Reasoning
gzip.decompress on a response body and comparison to the expected string 'hello, world!' is a dummy-server integration test assertion. It verifies that the server's gzip output round-trips.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/urllib3/urllib3 urllib3 && cd urllib3
git checkout 2.8.0
disclude scan --severity info --diff 2.7.0 .