# Gitea — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30
Target: https://github.com/go-gitea/gitea (Go)
Focus: models/, services/, routers/, modules/ — permissions, issues, reviews, actions, git operations

## Summary

No CWE-407 defects found. Gitea has a dedicated `container.Set[T]` (modules/container/set.go)
that wraps `map[T]struct{}` for O(1) membership tests. Hot paths use this correctly.

91 `slices.Contains` calls found across 59 files, but all operate on:

- Constant-size unit type arrays (< 10 elements)
- Config-level whitelist/blacklist IDs (branch protection, actions config)
- Small fixed enum slices (action types, user types, comment types)
- Single-call patterns not inside loops

## Notable non-defects reviewed

- `models/actions/runner.go` CanMatchLabels — uses container.SetOf() (hash set) correctly
- `models/git/protected_branch.go` updateTeamWhitelist — settings-update path, small lists
- `models/actions/task.go` CreateTaskForRunner — uses CanMatchLabels with hash set
- `models/issues/issue.go` IsParticipant — single slices.Contains, not in a loop
- `models/issues/review_list.go` — uses map[int64]*User for O(1) lookup
- `modules/dump/dumper.go` shouldExclude — CLI dump path, excludes list < 10
- `services/actions/notifier_helper.go` — DisabledWorkflows typically < 10