game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems

defects/gin/patch/gin-0001-method-trees-map.patch

@@ -0,0 +1,64 @@
+--- a/gin.go
++++ b/gin.go
+@@ -181,6 +181,7 @@ type Engine struct {
+ 	// ...existing fields...
+ 	trees            methodTrees
++	methodMap        map[string]*node   // O(1) method → radix-tree root
+ 	// ...existing fields...
+ }
+
+@@ -219,6 +220,7 @@ func New(opts ...OptionFunc) *Engine {
+ 	engine := &Engine{
+ 		// ...existing initialisers...
+ 		trees: make(methodTrees, 0, 9),
++		methodMap: make(map[string]*node, 9),
+ 	}
+ 	// ...
+ }
+
+@@ -366,6 +368,7 @@ func (engine *Engine) addRoute(method, path string, handlers HandlersChain) {
+ 	root := engine.trees.get(method)
+ 	if root == nil {
+ 		root = new(node)
+ 		root.fullPath = "/"
+ 		engine.trees = append(engine.trees, methodTree{method: method, root: root})
++		engine.methodMap[method] = root
+ 	}
+ 	root.addRoute(path, handlers)
+ 	// ...
+ }
+
+--- a/gin.go (handleHTTPRequest)
++++ b/gin.go
+@@ -706,15 +706,10 @@ func (engine *Engine) handleHTTPRequest(c *Context) {
+ 	// Find root of the tree for the given HTTP method
+-	t := engine.trees
+-	for i, tl := 0, len(t); i < tl; i++ {
+-		if t[i].method != httpMethod {
+-			continue
+-		}
+-		root := t[i].root
++	if root, ok := engine.methodMap[httpMethod]; ok {
+ 		// Find route in tree
+ 		value := root.getValue(rPath, c.params, c.skippedNodes, unescape)
+ 		if value.params != nil {
+ 			c.Params = *value.params
+ 		}
+ 		if value.handlers != nil {
+ 			c.handlers = value.handlers
+ 			c.fullPath = value.fullPath
+ 			c.Next()
+ 			c.writermem.WriteHeaderNow()
+ 			return
+ 		}
+ 		if httpMethod != http.MethodConnect && rPath != "/" {
+ 			if value.tsr && engine.RedirectTrailingSlash {
+ 				redirectTrailingSlash(c)
+ 				return
+ 			}
+ 			if engine.RedirectFixedPath && redirectFixedPath(c, root, engine.RedirectFixedPath) {
+ 				return
+ 			}
+ 		}
+-		break
+ 	}