disclude.ioPyPI / zope.interface / 8.7
zope.interface 8.7
- Source
- https://github.com/zopefoundation/zope.interface
- Artifact scanned
zope_interface-8.7.tar.gz- Compared with
zope_interface-8.6.tar.gz(2 signals introduced since)- Files
- 88 scanned, 10 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 25 info
- Scan time
- 14.9 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 25 of 25 warn and critical signals; 25 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 11:48
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
; then if [; thenlikely benign Build helper invokes pip via a variable-selected Python interpreter path.Reasoning
Script runs pip/tox from a PYBIN variable set by the manylinux build environment; this is a standard pattern in the pypa manylinux helper scripts. The variable is a caller-controlled interpreter path, not an obfuscated payload.
-
if [; thenlikely benign Editable install and wheel build through the selected interpreter's pip.Reasoning
Same PYBIN-based pip invocations for editable install and wheel building inside a manylinux container; expected for multi-interpreter builds.
-
TOXENV=likely benign Installs and runs tox for test environment selected by a mapping function.Reasoning
Installs tox and runs it with an environment name derived from a helper function; routine test orchestration in a build script.
-
TOXENV=likely benign Runs tox test environment in the build container.Reasoning
Runs tox with the environment computed earlier; no decoding or remote fetching visible. Ordinary CI test step.
-
= or = or .likely benign Uses caller frame globals to resolve implementation names in zope.interface compatibility code.Reasoning
sys._getframe(1).f_globals is a well-known idiom in zope.interface for defining classes in the caller's module namespace; it is legitimate framework code.
-
=likely benign Test constructor opens the test module itself as a file object.Reasoning
Opening __file__ in a test to provide a file-like object for IFile conformance testing is benign; no payload extraction or decoding occurs.
-
info
warn→ info by reviewframe-introspectionsrc/zope/interface/common/tests/test_collections.py:101:17returnlikely benign Test helper obtains the frame locals proxy type for conformance checks.Reasoning
Retrieves the type of frame locals to test FrameLocalsProxy conformance; a test helper with no malicious behavior.
-
info
warn→ info by reviewframe-introspectionsrc/zope/interface/common/tests/test_collections.py:133:44return = =likely benign Test constructs a FrameLocalsProxy from the current frame.Reasoning
Passes current frame to a FrameLocalsProxy constructor in a test; benign introspection for test coverage of a builtin type.
-
""" frame = sys._getframe(1) # pylint:disable=protected-access locals = frame.f_locals # pylint:disable=redefined-builtinlikely benign Reads caller frame locals for class advice in zope.interface declarations.Reasoning
Caller-frame locals access is the documented mechanism of zope.interface's implementer-style class advice helpers; standard framework behavior.
-
= . = =likely benign Invariant decorator attaches data to the defining class namespace via caller frame.Reasoning
Caller-frame locals store tagged data for the invariant decorator; this is the documented zope.interface definition-time mechanism.
-
"""Attaches a tagged value to an interface at definition time.""" = . = =likely benign Tagged value helper writes to the caller's class namespace.Reasoning
Same definition-time tagged-value mechanism via caller frame locals; legitimate framework design.
-
# could be raised. = . # Get the C optimized __module__ accessor and give it # to the new class.likely benign Sets __module__ of an interface from the caller's globals.Reasoning
Reads caller module __name__ to set __module__ on new interface classes; standard framework practice.
-
""" f_locals = sys._getframe(1).f_locals methods = f_locals.setdefault(INTERFACE_METHODS, {}) methods[func.__name__] = funclikely benign Method decorator registers functions into the interface namespace via caller frame.Reasoning
Caller-frame locals used to collect interface methods at definition time; documented zope.interface behavior.
-
# a class, but of course it does it in C. :-/ = . # pragma: no cover passlikely benign Assigns __module__ from caller globals during class creation.Reasoning
Sets __module__ from caller globals inside a try block for class creation; ordinary framework code.
-
= =likely benign Test fixture calling sys._getframe to exercise getFrameInfo.Reasoning
sys._getframe is used to test frame-introspection helpers for zope.interface advice; this is a test fixture, not malicious.
-
=likely benign Module-level sys._getframe call in a zope.interface advice test fixture.Reasoning
Same test fixture pattern at module level, testing frame info retrieval in a legitimate library test suite.
-
, , , =likely benign Unit test checking getFrameInfo results using sys._getframe.Reasoning
The critical severity comes from co-occurrence with exec/eval elsewhere in the file, but the snippet is a unit test asserting frame info from getFrameInfo; a well-known legitimate library test.
-
=likely benign Test comparing frame locals obtained via sys._getframe.Reasoning
Test asserts frame locals match expected values; no anti-analysis behavior, just introspection testing within the zope.interface test suite.
-
=likely benign Test executes a fixed test string via exec to verify advice frame detection.Reasoning
exec runs a module-level constant _FUNKY_EXEC with controlled globals and locals to test advice behavior under exec; a deliberate test of the library's frame handling, not an attack.
-
info
warn→ info by reviewdecoder-import-with-execsrc/zope/interface/tests/test_declarations.py:59:17return Falselikely benign Test helper executing compiled test code to check TypeError behavior.Reasoning
The try block runs exec on a code object within a test helper checking whether a class-level construct raises TypeError; the pickle import is incidental in a zope test suite, not a payload loader.
-
return Falselikely benign Test helper exec of test code object in declarations tests.Reasoning
Same exec helper in the zope.interface declarations test; exec of a test-provided code object for behavior checking, no payload or network activity.
-
]) =likely benign Test executes a fixed CODE string to verify module-scope declaration behavior.Reasoning
exec of a fixed module-level CODE string with dict namespaces to define test functions; standard technique for testing module-scope behavior.
-
likely benign Test executes fixed CODE inside assertRaises to check TypeError.
Reasoning
Same fixed-CODE exec inside assertRaises in a zope.interface test, validating a TypeError for module-scope usage.
-
]) =likely benign Test execs fixed CODE to inspect __provides__ spec from module scope.Reasoning
Fixed CODE string exec'd into a globals dict to check __provides__ handling; a typical test pattern in this library.
-
likely benign Test execs fixed CODE expecting TypeError in module-scope declaration checks.
Reasoning
Fixed CODE exec within assertRaises in the same declarations test module; benign test scaffolding.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&