russell@unturf.com
65c4a2c263
bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only gin: no new defects beyond gin-0001 (existing) fiber: no new defects beyond fiber-0001 (existing)
31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
# CWE-407 Scan — bottle (Python micro web framework)
|
|
|
|
**Result: CLEAN**
|
|
**Date: 2026-03-30**
|
|
**Repo:** https://github.com/bottlepy/bottle (depth=1)
|
|
|
|
## Scan Summary
|
|
|
|
Scanned `bottle.py` (single-file framework) for O(N²) list membership patterns:
|
|
visited/seen list accumulation, `not in list` guards inside loops, and plugin/route dedup.
|
|
|
|
## Findings
|
|
|
|
No CWE-407 defects found.
|
|
|
|
### Key paths examined
|
|
|
|
| Path | Pattern | Verdict |
|
|
|------|---------|---------|
|
|
| `Router.match()` | Static routes use `dict` (O(1)), dynamic routes use combined regex | CLEAN |
|
|
| `Route.all_plugins()` | Dedup via `unique = set()` + `unique.add(name)` | CLEAN |
|
|
| `Bottle._mount_app()` | `self._mounts.append(app)` with no inner loop membership check | CLEAN |
|
|
| `SimpleTemplate._include()` | `self.cache[_name]` dict lookup for template inclusion | CLEAN |
|
|
| `_NamespacedImporter.load_module()` | `sys.modules` dict check — O(1) | CLEAN |
|
|
| `Bottle.remove_hook()` | `func in self._hooks[name]` single scan to remove — not in a loop | CLEAN |
|
|
|
|
### Why bottle is clean
|
|
|
|
Bottle's routing layer uses Python `dict` for static routes (O(1) lookup). Dynamic routes
|
|
are compiled into combined regexes. Plugin deduplication uses a `set()`. Template inclusion
|
|
uses a per-template dict cache. No accumulating visited-list inside an outer loop was found.
|