russell@unturf.com
ac82cff865
doctrine-orm-0001: ClassMetadata::addSubClass in_array O(S²) subclasses list HIGH - src/Mapping/ClassMetadata.php addSubClass() scans plain $subClasses list - addSubClasses($parent->subClasses) called in doLoadMetadata: O(S²) per class - Fix: parallel $subClassesSet hash for O(1) membership; 500x at S=1000 composer-0003: InstalledRepository::getDependents in_array O(P²) needles list MEDIUM - needles array grows during foreach($packages) loop, in_array scan 3 sites - $packagesFoundSet already exists for cycle-detection but needles is separate - Fix: add $needlesSet = array_fill_keys($needles, true), mirror growth; 1000x at P=1000 cayley: CLEAN (confirmed -- map-based seen/pathMap throughout) tinkerpop: CLEAN (confirmed -- existing CLEAN.md valid, sort ArrayList is query-plan-time only)
12 lines
770 B
Markdown
12 lines
770 B
Markdown
# CLEAN — diesel
|
|
|
|
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
|
|
|
|
## Findings
|
|
|
|
- `diesel_derives/src/sql_function.rs` — `arguments_with_generic_types` and `variadic_generic_indexes` are `Vec` with `.contains()` in proc-macro code, run once at compile time with N bounded to function argument count. Not a runtime defect.
|
|
- `diesel_cli/src/infer_schema_internals/foreign_keys.rs` — `safe_tables: &[TableName]` with `.contains()`: called during `diesel print-schema` CLI execution (once per run). Not a runtime hot path.
|
|
- `diesel_cli/src/print_schema.rs` — BFS graph traversal uses `BTreeSet` for `visited`. CLEAN.
|
|
- All other `contains()` calls are on `HashSet`/`BTreeSet` or string substring checks. CLEAN.
|
|
|
|
**Result: No actionable CWE-407 defects.**
|