java-topology/defects/deno/patch/deno-CLEAN.md

UNDF: UNDF-2026-000000376

deno — CLEAN

Scanned: 2026-03-27 Files checked:

• runtime/permissions/lib.rs (9194 lines) — permission descriptor dedup
• runtime/worker.rs (1347 lines) — worker setup

Result

No CWE-407 defects found.

The permission system (UnaryPermissionSet, DescriptorPermissionMap) uses Rust's IndexSet / HashSet / BTreeMap throughout for O(1) membership checks. The descriptors.iter().any(...) calls in is_flag_denied and insert_granted are single O(N) passes with no outer loop driving them into O(N²) territory — they are invoked once per permission query, not once per element in a collection being iterated.

No linear dedup inside a loop pattern was identified.