Web Infrastructure — CWE-407 Scan Results
==========================================

.. contents:: :local:

Summary
-------

All web infrastructure components scanned 2026-03-23. **All CLEAN.**

+-------------+-------------------+----------------------------------------------------------+
| Component   | Language          | Finding                                                  |
+=============+===================+==========================================================+
| PHP Zend    | C                 | CLEAN — ``zend_bitset_in`` = bitwise AND, O(1)          |
+-------------+-------------------+----------------------------------------------------------+
| Redis       | C                 | CLEAN — hashtable + skiplist, no graph traversal        |
+-------------+-------------------+----------------------------------------------------------+
| Varnish     | C                 | CLEAN — no candidates in VCC compiler or varnishd       |
+-------------+-------------------+----------------------------------------------------------+
| nginx       | C                 | CLEAN — no candidates in src/                           |
+-------------+-------------------+----------------------------------------------------------+
| Apache2     | C                 | CLEAN — no candidates in server/ or modules/            |
+-------------+-------------------+----------------------------------------------------------+
| Memcached   | C                 | CLEAN — hashtable primary storage, no graph traversal   |
+-------------+-------------------+----------------------------------------------------------+

Analysis
--------

The web infrastructure tier uses no graph traversal algorithms that would exhibit the
CWE-407 pattern. These systems process request/response streams, cache key-value pairs,
and proxy connections — none of which require SCC computation, cycle detection, or
dependency resolution over large graphs.

**PHP Zend Engine** was the highest-probability target: OPcache's optimizer performs
CFG construction, SSA, dataflow analysis (DFG), and sparse conditional dataflow (SCDF)
over bytecode graphs. Six ``zend_bitset_in`` calls were found near graph keywords, but
triage confirmed ``zend_bitset_in`` is a single bitwise AND (``ZEND_BIT_TEST`` macro) —
O(1). The DFG/SCDF passes use a word-array bitset throughout.

**Redis** cluster topology uses a consistent hash ring with O(1) slot assignment.
The replication graph uses integer flags per node, not list membership.

The CWE-407 sedimentary pattern requires: (1) a graph traversal algorithm, (2) a
``visited``/``onStack`` set, (3) implemented as a linked list or array. Web servers and
caches implement none of these. The defect class is structural to **compilers, build tools,
and routing protocol stacks** — not to request-processing infrastructure.

.. toctree::
   :maxdepth: 1

   php-zend
   redis
   varnish
   nginx
   apache2
