engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

cpp-systems: tor CLEAN.md updated to note existing patches tor-0001/0002/0003

Browse source 
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional
CWE-407 defects. All repos found CLEAN beyond previously recorded patches.
Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.
This commit is contained in:
russell@unturf.com 2026-03-29 19:54:59 -04:00
parent df8daceb3c
commit 068ebbd29f
21 changed files with 1069 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

20
defects/protobuf/patch/CLEAN.md Normal file
View file

@ -0,0 +1,20 @@
# CLEAN — Protocol Buffers (Java)
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
## Scope
Java library: java/core/src/main and java/util/src/main — Descriptors, DynamicMessage,
MessageLiteToString, JsonFormat, SchemaUtil, DescriptorMessageInfoFactory.
## Findings
### MessageLiteToString — setters.contains()
`setters` is `Set<String> setters = new HashSet<>()`. O(1). Clean.
### JsonFormat — includingDefaultValueFields.contains()
`includingDefaultValueFields` is `Set<FieldDescriptor>`. O(1). Clean.
### DescriptorMessageInfoFactory — specialFieldNames.contains()
`specialFieldNames` is a static `Set<String>`. O(1). Clean.
## Result
**CLEAN. No actionable CWE-407 defects found in Protocol Buffers Java library.**