java-topology/defects/drone/SCAN.md

1.3 KiB

Drone CI (Harness Gitness) 5-MOAD Scan — 2026-03-31

Target: https://github.com/harness/drone (depth=1)

MOAD-0001 (CWE-407) — 1 DEFECT FOUND

See drone-0001. pubsub/inmem.go Publish() calls slices.Contains(sub.topics, topic) for every subscriber — O(S*T) per Publish call.

MOAD-0002 (Intertangle) — CLEAN

Manager struct aggregates stores via dependency injection; each store interface is independently swappable. No shared mutable global state coupling pipeline execution to unrelated subsystems. Wire-based DI separates concerns cleanly.

MOAD-0003 (Leaked Context) — CLEAN

app/api/request/context.go uses context.Context (standard Go pattern for per-request identity). No goroutine-local or thread-local identity leakage found. Pattern matches Kubernetes apiserver context design.

MOAD-0004 (CWE-312) — CLEAN

Searched all log calls for token/secret/password/webhook literals. No credential values passed to zerolog log lines. Secret service logs error conditions only, never values. Webhook tokens are stored encrypted in DB, not logged.

MOAD-0005 (Thundering Herd) — 1 DEFECT FOUND

See drone-0002. cache/ttl_cache.go TTLCache.Get() has classic cache stampede: fetch (RLock miss) then getter.Find() with no lock, then write. Multiple goroutines can all miss and all call DB simultaneously.