wave17: 562/240 — vim/qemu/tcl/nodejs/bun/httpd-0002/systemd/emacs

defects/deno/patch/deno-CLEAN.md

@@ -0,0 +1,19 @@
+# deno — CLEAN
+
+**Scanned:** 2026-03-27
+**Files checked:**
+- `runtime/permissions/lib.rs` (9194 lines) — permission descriptor dedup
+- `runtime/worker.rs` (1347 lines) — worker setup
+
+## Result
+
+No CWE-407 defects found.
+
+The permission system (`UnaryPermissionSet`, `DescriptorPermissionMap`) uses
+Rust's `IndexSet` / `HashSet` / `BTreeMap` throughout for O(1) membership
+checks.  The `descriptors.iter().any(...)` calls in `is_flag_denied` and
+`insert_granted` are single O(N) passes with no outer loop driving them into
+O(N²) territory — they are invoked once per permission query, not once per
+element in a collection being iterated.
+
+No linear dedup inside a loop pattern was identified.