# CWE-407 Scan — actix-web (Rust web framework)

**Result: CLEAN**
**Date: 2026-03-30**
**Repo:** https://github.com/actix/actix-web (depth=1)

## Scan Summary

Scanned actix-web (actix-web, actix-http, actix-router) for O(N²) list membership
patterns: Vec::contains in hot paths, visited/seen accumulation, linear dedup.

## Findings

No CWE-407 defects found.

### Key paths examined

| Path | Pattern | Verdict |
|------|---------|---------|
| `middleware/logger.rs` | `exclude: HashSet<String>` — O(1) path exclusion per request | CLEAN |
| `http/header/accept_encoding.rs` | `supported_set: HashSet<_>` — O(1) encoding negotiation | CLEAN |
| `actix-http/src/requests/head.rs` | `Flags` bitflags — O(1) | CLEAN |
| `introspection.rs` `update_unique()` | `Vec::contains` but only called at route registration (startup), not per-request | CLEAN* |
| `actix-router/src/router.rs` | Linear scan over routes — O(R) per request, bounded, not O(N²) | CLEAN |

*Note: `introspection.rs` `update_unique<T>` and `externals.contains()` call
`Vec::contains` inside loops, but this only runs during application startup (route
registration phase), not during request handling. The vectors hold HTTP method names
and route pattern strings — typically O(10) elements. Not a runtime hot path.

### Why actix-web is clean

Per-request hot paths use bitflags and `HashSet` for all membership tests. The one
`Vec::contains` pattern in `introspection.rs` is confined to startup-time route
registration and operates on vectors bounded by the number of HTTP methods (9) and
route patterns defined by the user.