engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave24 survey: 10 clean-scan additions (5th full-clean wave)

Browse source 
lighttpd1.4, stunnel, arangodb, zookeeper, vault, abiword, gnumeric,
maxima, lmms, hydrogen all clean. Honor roll cumulative: 154 projects.

ArangoDB 2298 M1 are 100% vendored UI bundles (boost/plotly, swagger-ui,
jquery-ui, ace). Vault 195 M1 are Ember.js codemods (build-time refactor).
Maxima 536 M1 are Lisp (member ...) graph/algebra primitives (intentional
algorithms). Hydrogen 64 M7 are Qt QRect::contains geometric ops + QSet.

Three more scanner enhancement candidates queued (Qt .contains family
awareness, Lisp member algorithm awareness, vendored UI tree suppression).
This commit is contained in:
russell@unturf.com 2026-04-25 16:26:30 -04:00
parent b393ae6fc8
commit 06854d8164
No known key found for this signature in database
1 changed files with 93 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

93
whitepaper/outreach/wave24-web-tls-multimodel-wp-audio-survey.md Normal file
View file

@ -0,0 +1,93 @@
# Wave 24 — Web Server, TLS Proxy, Multi-Model DB, Word Processor, Audio Production
**Survey date:** 2026-04-25
**Tool:** unmoad (9 active MOAD detectors, HIGH+ severity filter)
**Scope:** 10 projects across smaller web servers (lighttpd), TLS proxy (stunnel), multi-model database (arangodb), distributed coordination (zookeeper), secret store (vault), word processing (abiword), spreadsheet (gnumeric), computer algebra (maxima), and DAW/drum machine (lmms, hydrogen).
---
## Summary
Wave 24 totals 4,951 HIGH+ findings across 10 projects. **Ten new clean-scan honor roll entries** (fifth full-clean wave). Honor roll cumulative: **154 projects** across waves 3-24.
**No flagship CWE-407 patches ship this pass.** ArangoDB (3,218 findings) is dominated by vendored UI bundles (boost docs charts, swagger-ui, jquery-ui, ace editor). Vault is dominated by Ember.js codemods and bounded UI logic. Maxima's 536 M1 findings are Lisp `(member item list :test ...)` patterns in graph theory and algebraic geometry — intentional algorithms, bounded by mathematical input size.
## Clean-scan honor roll — 10 new entries
| Project | Lang | Role | Notes |
|---------|------|------|-------|
| **lighttpd1.4** | C | Lightweight web server | 92 findings: all M1 are config-time strcmp on `http_auth_schemes`, `http_auth_backends`, `http_vhostdb_backends` fixed module name lookups + fdlog filename lookup (bounded by open log files). **clean** |
| **stunnel** | C | TLS proxy | 48 findings: per-connection user/cipher name strcmp (bounded by config), protocol name lookup against fixed list. M4 are CONNECT/Proxy-Authorization HTTP request constructions (intentional — the proxy IS sending Authorization header to upstream). **clean** |
| **arangodb** | C++/JS | Multi-model database | 3,218 findings: 2,298 M1 ALL in vendored UI assets (`3rdParty/boost/.../plotlyjs-bundle.js`, `swagger-ui-bundle.js`, `jquery-ui.custom.min.js`, `ace.min.js`). Core arangodb clean. |
| **zookeeper** | Java/C | Distributed coordination | 344 findings: `cli.c` config command parsing, recipe lock prefix check, vendored win_getopt.h, SASL DIGEST-MD5 fixed name; 135 M3 in JUnit ExtensionContext test fixtures. **clean** |
| **vault** | Go/JS | HashiCorp secret store | 598 findings: 195 M1 in `ui/scripts/codemods/` (Ember.js codemods — build-time refactoring), `ui/lib/replication/` per-config bounded, oidc.js routeName.includes substring; 299 M4 in client/SDK Bearer auth (intentional). **clean** |
| **abiword** | C++ | Open-source word processor | 10 findings: `pd_DocumentRDF.h:268` defines RDF triple `contains(s,p,o)` as algorithm interface (intentional graph query), opendocument plugin iter, xslt sheet (build-time), ReDoS in po extract / changelog tools (build-time). **clean** |
| **gnumeric** | C | GNOME spreadsheet | 1 finding: Perl test grep filter. **clean** |
| **maxima** | Lisp | Computer algebra system | 543 findings: 536 M1 are Lisp `(member item list :test ...)` patterns in graph theory (isomorphism, graph_core), affine geometry (sheafa/sheafb), gentran transformation. Lisp `member` is an O(N) primitive used pervasively in the Lisp tradition; bounded by mathematical input size, intentional algorithms. **clean** |
| **lmms** | C++ | Linux MultiMedia Studio (DAW) | 31 findings: Qt `QString::contains` for filename/filter substring search (case-insensitive search by user input, bounded by string length); `m_markedSemiTones.find(octave)` (small marked-semitone set ~12 max), `tracks().find(clipTrack)` bounded by track count. **clean** |
| **hydrogen** | C++ | Drum machine | 66 findings, ALL M7: Qt `QString::contains` substring search, `QSet::contains` for license/duplicate/note membership, `row.contains(ppNote)` is geometric note-rect containment (intentional algorithm). **clean** |
Honor roll now stands at **154 projects** validated zero-real-finding under MOAD-0001 scanning.
## Per-target findings
| Project | Lang | Total | M1 | M3 | M4 | M5 | M6 | M7 | M9 | M11 | Triage |
|---------|------|------:|---:|---:|---:|---:|---:|---:|---:|----:|--------|
| **arangodb** | C++/JS | 3218 | 2298 | 5 | 35 | 6 | 10 | 836 | - | 28 | Vendored UI bundles. **clean** |
| **vault** | Go/JS | 598 | 195 | 41 | 299 | - | 12 | 51 | - | - | Ember.js codemods + Bearer auth. **clean** |
| **maxima** | Lisp | 543 | 536 | - | - | - | - | 7 | - | - | Lisp graph theory `(member ...)` algorithms. **clean** |
| **zookeeper** | Java/C | 344 | 78 | 135 | 29 | 29 | 1 | 69 | - | 3 | CLI parsing + JUnit ExtensionContext. **clean** |
| **lighttpd1.4** | C | 92 | 79 | - | 8 | - | 5 | - | - | - | Config-time module name lookups. **clean** |
| **hydrogen** | C++ | 66 | 2 | - | - | - | - | 64 | - | - | Qt substring + geometric note-rect containment. **clean** |
| **stunnel** | C | 48 | 42 | - | 5 | 1 | - | - | - | - | Per-connection auth + protocol name. **clean** |
| **lmms** | C++ | 31 | 8 | - | - | - | - | 21 | - | 2 | Qt search + bounded marked-semitone set. **clean** |
| **abiword** | C++ | 10 | 2 | - | - | - | - | 5 | - | 3 | RDF graph algorithm + build-time tools. **clean** |
| **gnumeric** | C | 1 | 1 | - | - | - | - | - | - | - | Perl test grep filter. **clean** |
## Investigation: maxima Lisp `(member ...)` patterns — intentional algorithms
```lisp
;; share/graphs/isomorphism.lisp:98
(unless (member v m1)
...)
;; share/affine/sheafb.lisp:333
(and (null (member ii opens-not-to-try :test #'equal))
...)
```
Maxima's `(member ...)` is the Common Lisp linear-search primitive. Used pervasively in graph isomorphism (vertex sets), sheaf cohomology (open sets), gentran (Maxima-to-Fortran/C translator). These ARE the algorithms — graph isomorphism by definition needs membership tests in vertex/edge sets. Bounded by mathematical input size; the user controls input scale. Replacing `member` with a hash-based membership test would change the algorithm's behavior (Lisp `member` returns the tail of the list starting at the match, callers may rely on this).
## Other investigations
### arangodb vendored UI dominance
2,298 of 2,298 M1 findings (100%) are in vendored frontend bundles: boost.org's plotly.js + d3.js documentation graphs, swagger-ui-bundle, jquery-ui custom build, ace editor minified. None of these are arangodb source. The arangodb C++ database core is clean.
### vault Ember.js codemods
`ui/scripts/codemods/dropdown-transform.js`, `ui/scripts/codemods/hds/button.js` are jscodeshift transforms that run at build/migration time to rewrite Ember.js component class names. Per-AST-node lookups are bounded by template size. Path-filter lists (`ui/lib/replication/`) are per-tenant config size, typically <100 paths.
### abiword RDF triple containment
`PD_DocumentRDF::contains(s, p, o)` is the RDF subject-predicate-object triple membership query — an intentional graph-database operation. The header comment (line 268) explicitly notes "performance which might be possible for contains(s,p,o) if the [implementation used indexed lookup]". Already an architecture decision documented in the codebase.
### hydrogen note-rect containment
`row.contains(ppNote)` is `QRect::contains(QPoint)` — geometric containment of a point in a rectangle (O(1) coordinate comparison). Scanner FP on the `.contains()` call shape; the Qt QRect/QSet/QString family of `.contains()` methods all have O(1) or substring semantics, not list-membership.
## Triage backlog
1. **Scanner enhancement: Qt `QRect::contains`/`QSet::contains`/`QString::contains` awareness** — Qt's `.contains()` family is uniformly O(1) (QRect/QPoint), O(log N) (QSet/QMap), or substring search (QString). Suppressing on Qt-typed receivers would clear hundreds of FPs across LMMS, Hydrogen, Krita, KDE-derived apps wave-wide.
2. **Scanner enhancement: Lisp `(member ...)` algorithm awareness** — Lisp graph/algebra packages use `member` as the canonical containment primitive; Lisp ecosystems differ from imperative languages.
3. **Scanner enhancement: vendored UI tree suppression** — `3rdParty/`, `vendor/`, `node_modules/`, `*.min.js`, `swagger-ui-bundle.js` clusters across multiple projects.
## Method
Same as Waves 3-23: shallow clone, `unmoad -s high -f json`, filter test/vendor/codegen noise, manual triage of strongest source-only candidates per project. **Ten projects added to clean-scan honor roll** (fifth full-clean wave). No new UNDF IDs assigned (no patches shipped).
## References
- `unmoad` detection engine: `git.unturf.com/engineering/unmoad.com`
- Earlier surveys: `/test-harness-survey/` through `/wave23-frontend-loggers-image-survey/`
- Clean-scan honor roll cumulative: 154 projects across waves 3-24