engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bottle/gorm/axum/actix-web/gin/fiber: CWE-407 scan; 0 new defects, 4 CLEAN

Browse source 
bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict
gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps
axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains
actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only
gin: no new defects beyond gin-0001 (existing)
fiber: no new defects beyond fiber-0001 (existing)
This commit is contained in:
russell@unturf.com 2026-03-29 21:56:05 -04:00
parent 9325c98470
commit 65c4a2c263
4 changed files with 117 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

38
defects/actix-web/patch/CLEAN.md
View file

@ -1,12 +1,36 @@
# CLEAN — actix-web
# CWE-407 Scan — actix-web (Rust web framework)
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
**Result: CLEAN**
**Date: 2026-03-30**
**Repo:** https://github.com/actix/actix-web (depth=1)
## Scan Summary
Scanned actix-web (actix-web, actix-http, actix-router) for O(N²) list membership
patterns: Vec::contains in hot paths, visited/seen accumulation, linear dedup.
## Findings
- `actix-web/src/middleware/logger.rs` — `exclude` is `HashSet<String>`: O(1) per-request lookup. CLEAN.
- `actix-web/src/http/header/accept_encoding.rs` — `supported_set` collected as `HashSet<&Encoding>` before iteration. CLEAN.
- `actix-web/src/introspection.rs` — `update_unique` uses `Vec::contains()` for HTTP methods/guards/patterns, but these lists are bounded to <10 items each and only called once at app startup (route registration), not per request. Not actionable.
- All other `contains()` calls use bitflags, ranges, or string substring checks — not collection membership.
No CWE-407 defects found.
**Result: No actionable CWE-407 defects.**
### Key paths examined
| Path | Pattern | Verdict |
|------|---------|---------|
| `middleware/logger.rs` | `exclude: HashSet<String>` — O(1) path exclusion per request | CLEAN |
| `http/header/accept_encoding.rs` | `supported_set: HashSet<_>` — O(1) encoding negotiation | CLEAN |
| `actix-http/src/requests/head.rs` | `Flags` bitflags — O(1) | CLEAN |
| `introspection.rs` `update_unique()` | `Vec::contains` but only called at route registration (startup), not per-request | CLEAN* |
| `actix-router/src/router.rs` | Linear scan over routes — O(R) per request, bounded, not O(N²) | CLEAN |
*Note: `introspection.rs` `update_unique<T>` and `externals.contains()` call
`Vec::contains` inside loops, but this only runs during application startup (route
registration phase), not during request handling. The vectors hold HTTP method names
and route pattern strings — typically O(10) elements. Not a runtime hot path.
### Why actix-web is clean
Per-request hot paths use bitflags and `HashSet` for all membership tests. The one
`Vec::contains` pattern in `introspection.rs` is confined to startup-time route
registration and operates on vectors bounded by the number of HTTP methods (9) and
route patterns defined by the user.