gitlab-foss: 5 CWE-407 defects — Network::Graph find_free_space/overlap O(R*S), NotificationService mentioned_users O(R*M), RefreshService commit_ids O(MR*C), Project#members_among O(U*A); 4/4 PASS

defects/gitea/patch/CLEAN.md

@@ -0,0 +1,27 @@
+# Gitea — CWE-407 Scan Result: CLEAN
+
+Scanned: 2026-03-30
+Target: https://github.com/go-gitea/gitea (Go)
+Focus: models/, services/, routers/, modules/ — permissions, issues, reviews, actions, git operations
+
+## Summary
+
+No CWE-407 defects found. Gitea has a dedicated `container.Set[T]` (modules/container/set.go)
+that wraps `map[T]struct{}` for O(1) membership tests. Hot paths use this correctly.
+
+91 `slices.Contains` calls found across 59 files, but all operate on:
+
+- Constant-size unit type arrays (< 10 elements)
+- Config-level whitelist/blacklist IDs (branch protection, actions config)
+- Small fixed enum slices (action types, user types, comment types)
+- Single-call patterns not inside loops
+
+## Notable non-defects reviewed
+
+- `models/actions/runner.go` CanMatchLabels — uses container.SetOf() (hash set) correctly
+- `models/git/protected_branch.go` updateTeamWhitelist — settings-update path, small lists
+- `models/actions/task.go` CreateTaskForRunner — uses CanMatchLabels with hash set
+- `models/issues/issue.go` IsParticipant — single slices.Contains, not in a loop
+- `models/issues/review_list.go` — uses map[int64]*User for O(1) lookup
+- `modules/dump/dumper.go` shouldExclude — CLI dump path, excludes list < 10
+- `services/actions/notifier_helper.go` — DisabledWorkflows typically < 10