27 lines
1.3 KiB
Markdown
27 lines
1.3 KiB
Markdown
## Drone CI (Harness Gitness) 5-MOAD Scan — 2026-03-31
|
|
|
|
Target: https://github.com/harness/drone (depth=1)
|
|
|
|
### MOAD-0001 (CWE-407) — 1 DEFECT FOUND
|
|
See drone-0001. pubsub/inmem.go Publish() calls slices.Contains(sub.topics, topic)
|
|
for every subscriber — O(S*T) per Publish call.
|
|
|
|
### MOAD-0002 (Intertangle) — CLEAN
|
|
Manager struct aggregates stores via dependency injection; each store interface is
|
|
independently swappable. No shared mutable global state coupling pipeline execution
|
|
to unrelated subsystems. Wire-based DI separates concerns cleanly.
|
|
|
|
### MOAD-0003 (Leaked Context) — CLEAN
|
|
app/api/request/context.go uses context.Context (standard Go pattern for
|
|
per-request identity). No goroutine-local or thread-local identity leakage found.
|
|
Pattern matches Kubernetes apiserver context design.
|
|
|
|
### MOAD-0004 (CWE-312) — CLEAN
|
|
Searched all log calls for token/secret/password/webhook literals. No credential
|
|
values passed to zerolog log lines. Secret service logs error conditions only,
|
|
never values. Webhook tokens are stored encrypted in DB, not logged.
|
|
|
|
### MOAD-0005 (Thundering Herd) — 1 DEFECT FOUND
|
|
See drone-0002. cache/ttl_cache.go TTLCache.Get() has classic cache stampede:
|
|
fetch (RLock miss) then getter.Find() with no lock, then write. Multiple goroutines
|
|
can all miss and all call DB simultaneously.
|