engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

openssl-0004 + uwsgi-0001: 2 new defects (500x/249x); all 10 missing whitepaper entries restored; count 590→592

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 22:20:52 -04:00
parent 2e4f7807d5
commit 34e8d9212f
18 changed files with 1366 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

24
defects/hypercorn/patch/hypercorn-CLEAN.md Normal file
View file

@ -0,0 +1,24 @@
# hypercorn — CWE-407 Scan: CLEAN
**Date:** 2026-03-27
**Scope:** Full Python codebase (`src/hypercorn/`)
## Findings
No CWE-407 defects confirmed.
### Patterns examined
| Location | Pattern | Verdict |
|----------|---------|---------|
| `hypercorn/utils.py:filter_pseudo_headers` | single-pass over headers list | CLEAN — O(H), no inner scan |
| `hypercorn/utils.py:build_and_validate_headers` | single-pass over headers list | CLEAN — O(H), no inner scan |
| `hypercorn/protocol/http_stream.py:160,206,232` | `for name, value in scope["headers"]` with `break` | CLEAN — O(H) early-exit scans, not nested |
| `hypercorn/protocol/h2.py` | HTTP/2 stream management via `dict[int, stream]` | CLEAN — dict-keyed by stream_id, O(1) lookup |
| `hypercorn/middleware/dispatcher.py` | `for path, app in self.mounts.items()` | CLEAN — mount table is small and bounded |
| `hypercorn/config.py:response_headers` | `for alt_svc_header in self.alt_svc_headers` | CLEAN — alt_svc_headers bounded (1-2 entries typical) |
## Conclusion
Hypercorn uses single-pass header iterations throughout and relies on dicts
for stream management. No quadratic patterns found.