game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems

defects/fiber/patch/fiber-0001-custom-binder-map.patch

@@ -0,0 +1,66 @@
+--- a/app.go
++++ b/app.go
+@@ -98,6 +98,8 @@ type App struct {
+ 	// ...existing fields...
+ 	customBinders []CustomBinder
++	customBindersByMIME map[string]CustomBinder
++	customBindersByName map[string]CustomBinder
+ 	// ...
+ }
+
+@@ -549,6 +551,8 @@ func New(config ...Config) *App {
+ 	app := &App{
+ 		// ...existing...
+ 		customBinders: []CustomBinder{},
++		customBindersByMIME: make(map[string]CustomBinder),
++		customBindersByName: make(map[string]CustomBinder),
+ 	}
+ 	// ...
+ }
+
+@@ -733,6 +735,9 @@ func (app *App) RegisterCustomBinder(customBinder CustomBinder) {
+ 	app.customBinders = append(app.customBinders, customBinder)
++	for _, mime := range customBinder.MIMETypes() {
++		app.customBindersByMIME[mime] = customBinder
++	}
++	app.customBindersByName[customBinder.Name()] = customBinder
+ }
+
+--- a/bind.go
++++ b/bind.go
+@@ -389,12 +389,10 @@ func (b *Bind) Body(out any) error {
+ 	ctype = binder.FilterFlags(utils.ParseVendorSpecificContentType(ctype))
+
+ 	// Check custom binders — O(1) map lookup instead of O(B×M) nested scan
+-	binders := b.ctx.App().customBinders
+-	for _, customBinder := range binders {
+-		if slices.Contains(customBinder.MIMETypes(), ctype) {
+-			if err := b.returnBindErr(customBinder.Parse(b.ctx, out), BindSourceBody); err != nil {
+-				return err
+-			}
+-			return b.validateStruct(out)
++	if customBinder, ok := b.ctx.App().customBindersByMIME[ctype]; ok {
++		if err := b.returnBindErr(customBinder.Parse(b.ctx, out), BindSourceBody); err != nil {
++			return err
+ 		}
++		return b.validateStruct(out)
+ 	}
+
+@@ -213,10 +213,8 @@ func (b *Bind) Custom(name string, dest any) error {
+-	binders := b.ctx.App().customBinders
+-	for _, customBinder := range binders {
+-		if customBinder.Name() == name {
+-			if err := b.returnBindErr(customBinder.Parse(b.ctx, dest), name); err != nil {
+-				return err
+-			}
+-			return b.validateStruct(dest)
+-		}
++	if customBinder, ok := b.ctx.App().customBindersByName[name]; ok {
++		if err := b.returnBindErr(customBinder.Parse(b.ctx, dest), name); err != nil {
++			return err
+ 	}
++		return b.validateStruct(dest)
++	}
+
+ 	return ErrCustomBinderNotFound
+ }