ExaBGP — CWE-407 Analysis
==========================

.. contents:: :local:

Overview
--------

ExaBGP is a Python-based BGP implementation primarily used for BGP traffic engineering,
route injection, and network monitoring. It is used in production by large networks for
anycast management and DDoS mitigation.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

Scan returned 22 candidates. All triaged as false positives.

Triage Notes
------------

The 22 candidates fell into three categories:

1. **``dict`` index operations** — Python ``dict`` key lookup is O(1). Patterns like
   ``x in some_dict`` matched the scanner's ``in (path|stack|visited)`` keyword filter but
   the container is always a ``dict``, not a ``list``.

2. **OS path operations** — ``os.path`` calls containing the word ``path`` matched the
   keyword filter but are file-system operations unrelated to graph traversal.

3. **String methods** — ``str.find()`` and string ``in`` operator in protocol message
   parsing. Not membership in a visited-node set.

BGP AS-path loop detection uses ``as_path.as_set`` (a Python ``set``) for loop checking:
O(1). The RIB uses ``dict``-backed route stores throughout. No list-backed visited sets found.

References
----------

* Scan result: ``tools/scan-results/exabgp.txt``
