wave16c: esbuild/deno CWE-407 scan results

esbuild-0001: serve_other.go hosts []string scan → map[string]struct{} (57x, MEDIUM)
deno: CLEAN (uses HashSet/HashMap throughout, no Vec.contains() in loops)

1 test: 1/1 PASS

defects/esbuild/patch/esbuild-0001-serve-hosts-map.patch

@@ -0,0 +1,43 @@
+--- a/pkg/api/serve_other.go
++++ b/pkg/api/serve_other.go
+@@ -48,7 +48,7 @@ type apiHandler struct {
+ 	keyfileToLower   string
+ 	certfileToLower  string
+ 	fallback         string
+-	hosts            []string
++	hosts            map[string]struct{}  // O(1) lookup per HTTP request; was O(H) []string scan
+ 	corsOrigin       []string
+ 	serveWaitGroup   sync.WaitGroup
+
+@@ -139,14 +139,10 @@ func (h *apiHandler) ServeHTTP(res http.ResponseWriter, req *http.Request) {
+ 	// Check the "Host" header to prevent DNS rebinding attacks
+ 	if strings.ContainsRune(req.Host, ':') {
+ 		if host, _, err := net.SplitHostPort(req.Host); err == nil {
+ 			req.Host = host
+ 		}
+ 	}
+-	if req.Host != "localhost" {
+-		ok := false
+-		for _, allowed := range h.hosts {
+-			if req.Host == allowed {
+-				ok = true
+-				break
+-			}
+-		}
+-		if !ok {
++	if req.Host != "localhost" {
++		if _, ok := h.hosts[req.Host]; !ok {
+ 			go h.notifyRequest(time.Since(start), req, http.StatusForbidden)
+ 			res.WriteHeader(http.StatusForbidden)
+ 			maybeWriteResponseBody([]byte(fmt.Sprintf("403 - Forbidden: The host %q is not allowed", req.Host)))
+
+@@ -894,7 +890,11 @@ func serve(ctx *bundleContext, serveOptions ServeOptions, result []BuildResult) (
+ 	handler := &apiHandler{
+ 		...
+-		hosts:            append([]string{}, result.Hosts...),
++		hosts: func() map[string]struct{} {
++			m := make(map[string]struct{}, len(result.Hosts))
++			for _, h := range result.Hosts { m[h] = struct{}{} }
++			return m
++		}(),
+ 		corsOrigin:       append([]string{}, serveOptions.CORS.Origin...),