# UNDF: UNDF-2026-000000802
# Scribus — 5-MOAD Scan Result

Scanned: 2026-04-01
Clone: https://github.com/scribusproject/scribus (depth=1)

## MOAD-0001 (CWE-407): 4 defects — PATCHED (scribus-0001/0002/0003/0004)

- scribus-0001: `getSortedStyleList` / `getSortedCharStyleList` / `getSortedTableStyleList` /
  `getSortedCellStyleList` — `QList<int>::contains()` inside O(S) loop → O(S²).
  Fix: companion `QSet<int>` for O(1) membership.
- scribus-0002: `getUsedPatterns` — `results.contains()` inside O(I×R) loop.
- scribus-0003: `Selection::addItems` — `m_SelList.contains()` inside O(N×M) loop.
- scribus-0004: file savers (`scribus150/170/171format_save.cpp`) — `names.contains()` on
  `QList<QString>` (from QMap::keys()) inside O(S) style-write loop → O(S²) per save.
  6 defect sites across 3 format variants. Fix: use `lists.charStyles().contains()` (QMap,
  O(log N)) directly instead of materialising a QList for linear scan. 375x at N=1000.

## MOAD-0002 (Intertangle): CLEAN

No shared mutable global god object coupling independent subsystems found.
`ScribusApp` and `ScribusDoc` are well-separated; document state is per-instance.

## MOAD-0003 (Leaked Context): CLEAN

No `thread_local` or `QThreadStorage` holding request-scoped document identity found.
Document context is passed explicitly through function parameters and pointers.

## MOAD-0004 (CWE-312): CLEAN

No network credential (password, auth token) logging found.
Scribus does not include networking features that authenticate over HTTP/SMTP/LDAP;
no logger calls adjacent to authentication credential handling were found.

## MOAD-0005 (Thundering Herd): CLEAN

No concurrent cache get+null+compute+put without synchronization found.
`ScImageCacheManager` uses file-level locking (`m_writeLockFile`) rather than
in-memory unsynchronized cache patterns; no `QCache` or similar structure exposed
to concurrent write without lock.