openoffice: 2 defects (MOAD-0001 xestyle O(N²) border/fill dedup, MOAD-0004 WebDAV credential logging); scribus: MOADs 0002-0005 CLEAN

defects/scribus/patch/SCAN.md

@@ -0,0 +1,35 @@
+# Scribus — 5-MOAD Scan Result
+
+Scanned: 2026-04-01
+Clone: https://github.com/scribusproject/scribus (depth=1)
+
+## MOAD-0001 (CWE-407): 3 defects — PATCHED (scribus-0001/0002/0003)
+
+- scribus-0001: `getSortedStyleList` / `getSortedCharStyleList` / `getSortedTableStyleList` /
+  `getSortedCellStyleList` — `QList<int>::contains()` inside O(S) loop → O(S²).
+  Fix: companion `QSet<int>` for O(1) membership.
+- scribus-0002: `getUsedPatterns` — `results.contains()` inside O(I×R) loop.
+- scribus-0003: `Selection::addItems` — `m_SelList.contains()` inside O(N×M) loop.
+
+## MOAD-0002 (Intertangle): CLEAN
+
+No shared mutable global god object coupling independent subsystems found.
+`ScribusApp` and `ScribusDoc` are well-separated; document state is per-instance.
+
+## MOAD-0003 (Leaked Context): CLEAN
+
+No `thread_local` or `QThreadStorage` holding request-scoped document identity found.
+Document context is passed explicitly through function parameters and pointers.
+
+## MOAD-0004 (CWE-312): CLEAN
+
+No network credential (password, auth token) logging found.
+Scribus does not include networking features that authenticate over HTTP/SMTP/LDAP;
+no logger calls adjacent to authentication credential handling were found.
+
+## MOAD-0005 (Thundering Herd): CLEAN
+
+No concurrent cache get+null+compute+put without synchronization found.
+`ScImageCacheManager` uses file-level locking (`m_writeLockFile`) rather than
+in-memory unsynchronized cache patterns; no `QCache` or similar structure exposed
+to concurrent write without lock.