russell@unturf.com
4d4c256673
cpython-0001: pydoc.allmethods unconditional __bases__ recursion, no visited guard cpython-0002: turtle.__methodDict unconditional __bases__ recursion, fires at import cpython-0003: idlelib.rpc._getmethods unconditional __bases__ recursion, IDLE debug path django-0006: migrations.state.flatten_bases abstract model diamond traversal (comment in source acknowledges duplicates) flask/rails/ruby/phoenix: CLEAN
15 lines
640 B
Markdown
15 lines
640 B
Markdown
# Flask — CWE-407 Diamond Traversal Scan: CLEAN
|
|
|
|
Scanned: 2026-03-30
|
|
|
|
## Files examined
|
|
|
|
- `src/flask/views.py` — `MethodView.__init_subclass__` iterates `cls.__bases__` but does NOT recurse; one-level only
|
|
- `src/flask/sansio/app.py` — `exc_class.__mro__` iteration (linear, no recursion)
|
|
- `src/flask/blueprints.py` — no class hierarchy traversal
|
|
|
|
## Result
|
|
|
|
No diamond recursion defects found. Flask does not perform recursive `__bases__` traversal.
|
|
The `__init_subclass__` hook in `MethodView` iterates one level of `__bases__` to collect
|
|
HTTP method names — this is O(B) where B is the number of direct bases, not recursive.
|