russell@unturf.com
65c4a2c263
bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only gin: no new defects beyond gin-0001 (existing) fiber: no new defects beyond fiber-0001 (existing)
31 lines
1.2 KiB
Markdown
31 lines
1.2 KiB
Markdown
# CWE-407 Scan — axum (Rust web framework)
|
|
|
|
**Result: CLEAN**
|
|
**Date: 2026-03-30**
|
|
**Repo:** https://github.com/tokio-rs/axum (depth=1)
|
|
|
|
## Scan Summary
|
|
|
|
Scanned axum (axum, axum-core, axum-extra, axum-macros) for O(N²) list membership
|
|
patterns: Vec::contains in loops, visited/seen accumulation, linear dedup.
|
|
|
|
## Findings
|
|
|
|
No CWE-407 defects found.
|
|
|
|
### Key paths examined
|
|
|
|
| Path | Pattern | Verdict |
|
|
|------|---------|---------|
|
|
| `routing/method_filter.rs` | `MethodFilter` is a `u16` bitmask — `contains()` is O(1) bitwise AND | CLEAN |
|
|
| `extract/ws.rs` | `sec_websocket_protocol: BTreeSet<HeaderValue>` — O(log N) | CLEAN |
|
|
| `routing/method_routing.rs:885` | `endpoint_filter.contains(filter)` — bitmask, O(1) | CLEAN |
|
|
| `response/sse.rs` | `EventFlags` bitflags — O(1) | CLEAN |
|
|
| `axum-extra/routing/typed.rs` | `String::contains('?')` — substring check, not collection | CLEAN |
|
|
|
|
### Why axum is clean
|
|
|
|
Axum uses bitmask flags (`MethodFilter`, `EventFlags`) for all method/flag membership
|
|
checks — O(1). WebSocket protocol set uses `BTreeSet` (O(log N)). No `Vec::contains`
|
|
call in a hot per-request path was found. The framework follows idiomatic Rust
|
|
conventions throughout.
|