russell@unturf.com
65c4a2c263
bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only gin: no new defects beyond gin-0001 (existing) fiber: no new defects beyond fiber-0001 (existing)
36 lines
1.6 KiB
Markdown
36 lines
1.6 KiB
Markdown
# CWE-407 Scan — actix-web (Rust web framework)
|
|
|
|
**Result: CLEAN**
|
|
**Date: 2026-03-30**
|
|
**Repo:** https://github.com/actix/actix-web (depth=1)
|
|
|
|
## Scan Summary
|
|
|
|
Scanned actix-web (actix-web, actix-http, actix-router) for O(N²) list membership
|
|
patterns: Vec::contains in hot paths, visited/seen accumulation, linear dedup.
|
|
|
|
## Findings
|
|
|
|
No CWE-407 defects found.
|
|
|
|
### Key paths examined
|
|
|
|
| Path | Pattern | Verdict |
|
|
|------|---------|---------|
|
|
| `middleware/logger.rs` | `exclude: HashSet<String>` — O(1) path exclusion per request | CLEAN |
|
|
| `http/header/accept_encoding.rs` | `supported_set: HashSet<_>` — O(1) encoding negotiation | CLEAN |
|
|
| `actix-http/src/requests/head.rs` | `Flags` bitflags — O(1) | CLEAN |
|
|
| `introspection.rs` `update_unique()` | `Vec::contains` but only called at route registration (startup), not per-request | CLEAN* |
|
|
| `actix-router/src/router.rs` | Linear scan over routes — O(R) per request, bounded, not O(N²) | CLEAN |
|
|
|
|
*Note: `introspection.rs` `update_unique<T>` and `externals.contains()` call
|
|
`Vec::contains` inside loops, but this only runs during application startup (route
|
|
registration phase), not during request handling. The vectors hold HTTP method names
|
|
and route pattern strings — typically O(10) elements. Not a runtime hot path.
|
|
|
|
### Why actix-web is clean
|
|
|
|
Per-request hot paths use bitflags and `HashSet` for all membership tests. The one
|
|
`Vec::contains` pattern in `introspection.rs` is confined to startup-time route
|
|
registration and operates on vectors bounded by the number of HTTP methods (9) and
|
|
route patterns defined by the user.
|