russell@unturf.com
a629bd0bbf
New defects (all PASS): - exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20 - minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24 - minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N) - minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N) - minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N) - mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000 - ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x - pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup, prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools, linux-kernel (pointer to linux/)
30 lines
1.3 KiB
Markdown
30 lines
1.3 KiB
Markdown
# Express CWE-407 Scan — CLEAN
|
|
|
|
**Scan date:** 2026-03-29
|
|
|
|
## Files scanned
|
|
|
|
- `lib/application.js` — routing setup, middleware registration
|
|
- `lib/request.js` — request parsing helpers
|
|
- `lib/response.js` — response formatting helpers
|
|
- `lib/utils.js` — ETag, MIME, trust-proxy utilities
|
|
- `lib/view.js` — template view resolution
|
|
- `lib/express.js` — module entry point
|
|
|
|
## Findings
|
|
|
|
- `lib/request.js` — `String.indexOf(',')`, `String.indexOf(':')` calls are single
|
|
O(N) string scans on header values, never inside loops over requests/routes.
|
|
- `lib/utils.js` — `type.indexOf('/')` and `str.indexOf(';')` are single-pass
|
|
content-type parser helpers; not called in nested loops.
|
|
- `lib/response.js` — `type.indexOf('/')` once per content-type set; no loop.
|
|
- `lib/application.js` — `methods.forEach(...)` iterates the 30 HTTP method names
|
|
once at module load time to register route handlers; not called per-request.
|
|
- `res.format()` — iterates the caller's key-map once; no inner membership scan.
|
|
- Vary header handling delegates to the `vary` npm package (not in-tree).
|
|
|
|
## Conclusion
|
|
|
|
No CWE-407 defects found in Express. All `indexOf`/`includes` calls occur in
|
|
single-pass string parsing or bounded startup loops, never as inner membership
|
|
checks nested inside per-request or per-route loops.
|