PyPI / virtualenv / 21.14.12

virtualenv 21.14.12

Source

https://github.com/pypa/virtualenv

Tag scanned

21.14.12

Compared with

21.14.11 (0 signals introduced since)

Files

208 scanned, 33 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 14 info

Scan time

7.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 02:16

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import docs/render_cli.py:40:34

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

           module_name, attr_name = self.options["module"], self.options["func"]
           parser_creator = getattr(__import__(module_name, fromlist=[attr_name]), attr_name)
           core_result = parse_parser(parser_creator())

   likely benign LLM, confidence 0.70 Dynamic import of a parser module named in a Sphinx directive option to build CLI docs.

   Reasoning

   This is a documentation-rendering tool (sphinx-argparse style) that imports a module named by a configured option and calls a parser factory from it. The dynamic import is driven by developer-supplied directive options, not untrusted input, so it is a legitimate plugin pattern, though it does allow arbitrary module import from the doc source.

2. info critical → info by review dynamic-import docs/render_cli.py:236:20

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       of_class = of_type.split(".")
       data = getattr(__import__(".".join(of_class[:-1]), fromlist=[of_class[-1]]), of_class[-1])
       return [n.literal("", text=",".join(data))], []

   likely benign LLM, confidence 0.75 Dynamic import of a class from a dotted type string used to render documentation.

   Reasoning

   The __import__ resolves a dotted type path taken from the documented option type string and fetches an attribute from it to render docs. This is a standard reflection pattern in documentation tooling and runs at doc build time only, not in shipped code.

3. info warn → info by review dynamic-execution docs/tutorial/getting-started.rst:102:21

   [embedded bash] command name is a variable (`$which`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

           (myproject) $ which python
           /home/user/myproject/bin/python

   dismissed LLM, confidence 0.85 Tutorial shell transcript using a command name shown as a variable.

   Reasoning

   This is a tutorial code block showing a shell session where $which is a transcript output placeholder or prompt sample, not executable code. Pass is raw-like ast over rst embedded bash, a false positive from a doc example.

4. info critical → info by review path-command-shadow docs/tutorial/getting-started.rst:109:23

   [embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)

           (myproject) PS> where.exe python
           C:\Users\user\myproject\Scripts\python.exe

   dismissed LLM, confidence 0.90 Windows tutorial showing where.exe output for the venv python path.

   Reasoning

   The snippet is a Windows where.exe lookup output in a tutorial showing where python lives in a venv. The 'redirect writes to python' flag is a misparse of a path in documentation prose; no redirect writing to a PATH binary is present.

5. info warn → info by review obfuscated-command-name docs/tutorial/getting-started.rst:110:9

   [embedded bash] command name contains 5 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)

           (myproject) PS> where.exe python
           C:\Users\user\myproject\Scripts\python.exe

   dismissed LLM, confidence 0.90 Windows where.exe example whose path backslashes triggered an escape-sequence flag.

   Reasoning

   Backslashes in a Windows path (C:\Users\...) are being misread as escape sequences in a command name. This is ordinary Windows path syntax in a documentation example with no hidden command.

6. info warn → info by review obfuscated-command-name docs/tutorial/getting-started.rst:117:9

   [embedded bash] command name contains 5 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)

           (myproject) C:\> where.exe python
           C:\Users\user\myproject\Scripts\python.exe

   dismissed LLM, confidence 0.90 Windows tutorial where.exe example with path backslashes flagged as escapes.

   Reasoning

   Same as the other where.exe tutorial example; backslashes in a Windows path are misclassified as obfuscation in a plain docs transcript.

7. info warn → info by review dynamic-execution docs/tutorial/getting-started.rst:127:17

   [embedded bash] command name is a variable (`$pip`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

       (myproject) $ pip install requests
       Collecting requests
         Using cached requests-2.32.3-py3-none-any.whl (64 kB)

   dismissed LLM, confidence 0.85 Tutorial shell transcript showing pip install output.

   Reasoning

   This is pip install output in a tutorial transcript. The $pip token is a prompt-style placeholder, not an unexplained executable selection in shipped code.

8. info warn → info by review dynamic-execution docs/tutorial/getting-started.rst:137:17

   [embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

       (myproject) $ python -c "import requests; print(requests.__file__)"
       /home/user/myproject/lib/python3.13/site-packages/requests/__init__.py

   dismissed LLM, confidence 0.85 Tutorial transcript showing python -c printing requests location.

   Reasoning

   Tutorial transcript showing python printing a module path; the variable-command flag is an artifact of prompt-style doc examples.

9. info warn → info by review obfuscated-command-name docs/tutorial/getting-started.rst:176:9

   [embedded bash] command name contains 3 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)

           PS> .\myproject\Scripts\python.exe -c "import sys; print(sys.prefix)"
           C:\Users\user\myproject
   
           PS> .\myproject\Scripts\pip.exe install httpx

   dismissed LLM, confidence 0.90 Tutorial showing running venv python.exe via a Windows relative path.

   Reasoning

   Windows relative-path invocation of a venv executable in a tutorial. The backslashes in .\myproject\Scripts\python.exe are normal Windows path separators, not command obfuscation.

10. info warn → info by review obfuscated-command-name docs/tutorial/getting-started.rst:185:9

    [embedded bash] command name contains 3 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)

            C:\> .\myproject\Scripts\python.exe -c "import sys; print(sys.prefix)"
            C:\Users\user\myproject
    
            C:\> .\myproject\Scripts\pip.exe install httpx

    dismissed LLM, confidence 0.90 Tutorial showing running venv pip.exe via a Windows relative path.

    Reasoning

    Same Windows relative-path venv invocation in a tutorial; backslashes are ordinary path separators.

11. info unicode-homoglyph tests/conftest.py:310:47

    identifier `èрт` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)

        # in PowerShell paths
        base = "'\";&&e-$ !%`|>__VIRTUAL_NAME__[1]èрт🚒♞中片-j"
        if IS_WIN:
            # NTFS path components cannot contain any of these, regardless of where they sit in the string

12. info unicode-mixed-script tests/conftest.py:310:47

    identifier `èрт` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

        # in PowerShell paths
        base = "'\";&&e-$ !%`|>__VIRTUAL_NAME__[1]èрт🚒♞中片-j"
        if IS_WIN:
            # NTFS path components cannot contain any of these, regardless of where they sit in the string

13. info unicode-homoglyph tests/unit/activation/test_batch.py:27:21

    identifier `èрт` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)

        """Exclude ampersands, which batch activation does not support in paths."""
        base = "'\";e-$ èрт🚒♞中片-j"
        if IS_WIN:
            base = base.replace('"', "").replace(";", "")

14. info unicode-mixed-script tests/unit/activation/test_batch.py:27:21

    identifier `èрт` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

        """Exclude ampersands, which batch activation does not support in paths."""
        base = "'\";e-$ èрт🚒♞中片-j"
        if IS_WIN:
            base = base.replace('"', "").replace(";", "")

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/pypa/virtualenv virtualenv && cd virtualenv
git checkout 21.14.12
disclude scan --severity info --diff 21.14.11 .