1.3 KiB
Drone CI (Harness Gitness) 5-MOAD Scan — 2026-03-31
Target: https://github.com/harness/drone (depth=1)
MOAD-0001 (CWE-407) — 1 DEFECT FOUND
See drone-0001. pubsub/inmem.go Publish() calls slices.Contains(sub.topics, topic) for every subscriber — O(S*T) per Publish call.
MOAD-0002 (Intertangle) — CLEAN
Manager struct aggregates stores via dependency injection; each store interface is independently swappable. No shared mutable global state coupling pipeline execution to unrelated subsystems. Wire-based DI separates concerns cleanly.
MOAD-0003 (Leaked Context) — CLEAN
app/api/request/context.go uses context.Context (standard Go pattern for per-request identity). No goroutine-local or thread-local identity leakage found. Pattern matches Kubernetes apiserver context design.
MOAD-0004 (CWE-312) — CLEAN
Searched all log calls for token/secret/password/webhook literals. No credential values passed to zerolog log lines. Secret service logs error conditions only, never values. Webhook tokens are stored encrypted in DB, not logged.
MOAD-0005 (Thundering Herd) — 1 DEFECT FOUND
See drone-0002. cache/ttl_cache.go TTLCache.Get() has classic cache stampede: fetch (RLock miss) then getter.Find() with no lock, then write. Multiple goroutines can all miss and all call DB simultaneously.