34 lines
849 B
Markdown
34 lines
849 B
Markdown
# UNDF: UNDF-2026-000000394
|
|
# fish — CLEAN
|
|
|
|
## Scan Date
|
|
|
|
2026-03-27
|
|
|
|
## Files Scanned
|
|
|
|
- `src/complete.rs` (completion dedup, wrap targets)
|
|
- `src/exec.rs` (process execution)
|
|
|
|
## Findings
|
|
|
|
No CWE-407 defects found. Fish shell has been rewritten in Rust and uses
|
|
appropriate data structures throughout.
|
|
|
|
### Completion dedup (`unique_completions_retaining_order`)
|
|
|
|
Uses `HashSet::insert()` for O(1) per-element dedup — correct.
|
|
|
|
### Completion tombstones (`COMPLETION_TOMBSTONES`)
|
|
|
|
`BTreeSet<WString>` — O(log N) lookup — not O(N). Correct.
|
|
|
|
### Wrap targets (`complete_add_wrapper`)
|
|
|
|
`Vec::contains()` on per-command wrapper list. The list is bounded by the
|
|
number of wraps registered for a single command (typically 1-5). Not a
|
|
cross-product loop. Correct.
|
|
|
|
### Verdict
|
|
|
|
CLEAN — no algorithmic complexity defects in scanned code paths.
|