engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undf: assign UNDF-2026-000000055 to solang-0001, stamp patch

Browse source
This commit is contained in:
russell@unturf.com 2026-03-29 19:50:40 -04:00
parent a7b08c7e05
commit 0ca0eed9f9
10 changed files with 328 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

17
defects/grpc/patch/CLEAN.md Normal file
View file

@ -0,0 +1,17 @@
# CLEAN — gRPC (multi-language)
Scanned 2026-03-29 for CWE-407.
## Scope
- Java source: `examples/android/helloworld/` only (no Java RPC core in this clone)
- C++ core: `core/lib/`, `src/core/` — service resolution, call handling
## Findings
gRPC's Java implementation in this repository is limited to example code. The core RPC runtime is implemented in C++ and uses protobuf-generated descriptors with flat-array or hash-map lookups for service and method resolution. No quadratic list-membership pattern was found in:
- Method descriptor building (protobuf ServiceDescriptor uses array indexing)
- Service type resolution (registry uses hash map)
- Call filter/interceptor chains (fixed-size arrays assembled at startup)
**Result: No actionable CWE-407 defects.**