russell@unturf.com
7491349edc
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup per broadphase step — even carries "too slow" self-admission comment (HIGH) bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per frame on m_collisionDisabledObjects plain array (MEDIUM) allegro5: CLEAN (vector_contains only on non-hot setup paths) box2d: CLEAN (v3 rewrite uses b2HashSet throughout) dry: CLEAN (HashSet/HashMap on all hot dedup paths)
16 lines
692 B
Markdown
16 lines
692 B
Markdown
# dendrite — CWE-407 Scan: CLEAN
|
|
|
|
Scanned: 2026-03-29
|
|
|
|
## Scope
|
|
|
|
- `roomserver/internal/query/query.go` — GetAuthChain: `authEventsMap = make(map[string]gomatrixserverlib.PDU)` (map-based dedup)
|
|
- `roomserver/internal/helpers/auth.go` — GetAuthEvents, loadAuthEvents: map-based
|
|
- `roomserver/internal/input/input_events.go` — fetchAuthEvents: map-based
|
|
- Federation auth chain traversal throughout: all use Go `map[string]T` for O(1) key lookup
|
|
|
|
## Verdict
|
|
|
|
No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
|
|
All room auth chain and event DAG traversal in Dendrite uses Go `map` for O(1)
|
|
deduplication. No slice-based linear scans in hot traversal paths.
|