Note: patches and tests committed in 1326aee (bundled with openra by parallel agent).
MOAD-0001 (CWE-407):
- widelands-0001: FindBobsCallback std::find dedup O(B^2) in map.cc, HIGH, 21.5x
36 callers: combat soldier finding, critter AI, ship fleet, worker tasks
- widelands-0002: find_reachable_immovables_unique std::find dedup O(N^2) in map.cc, MEDIUM, 28.7x
Called from soldier combat and player territory operations
- widelands-0003: cleanup_playerimmovables_area burnlist std::find O(N^2), MEDIUM, 29.6x
Called during territory changes (conquest, diplomacy)
All 3/3 unit tests PASS.
MOAD-0002: Global singletons (g_fh, g_sh, g_image_cache, g_gr) typical for game engine. CLEAN.
MOAD-0003: Single thread_local in rt_parse.cc, not request-scoped. CLEAN.
MOAD-0004: Passwords handled via SHA1 hash, never logged verbatim. CLEAN.
MOAD-0005: Mutex usage in network/sound. No unsynchronized cache patterns. CLEAN.
Scanned 1509 C# files in OpenRA (C# RTS game engine, Command & Conquer style).
MOAD-0001 (CWE-407): CLEAN. Exceptionally well-optimized. FrozenSet<string>
for config type checks, HashSet<Actor/CPos> for membership, binary search in
TraitDictionary, CellLayer bounds checks. Only List.Contains on small bounded
collections (<50 items).
MOAD-0002 (Intertangle): CLEAN. Trait-based ECS architecture. No god objects.
MOAD-0003 (Leaked Context): CLEAN. Single ThreadLocal for diagnostics only.
MOAD-0004 (CWE-312): CLEAN. Only public identifiers logged, no secrets.
MOAD-0005 (Thundering Herd): CLEAN. Single-threaded game logic, proper lock()
on multi-threaded subsystems.
