russell@unturf.com
39981c70ad
Renumbering fixes (collisions with pre-existing IDs): - spring-0001-annotations-scanner → spring-0007 (spring-0001 was already assigned) - hibernate-0001-class-hierarchy-helper → hibernate-validator-0003 (wrong ecosystem/numbering) - django-0006-migrations-flatten-bases → django-0007 (django-0006 was already assigned) New diamond defects from agents that rate-limited before committing: - micronaut-0007: SuperclassAwareTypeVisitor.getInterfaces O(2^D) (new site) - quarkus-0005: ConfigMappingUtils.collectInterfacesRec O(2^D) (new site) - weld-0005: Services.identifyServiceInterfaces O(2^D) (new site) - typescript-0005: hasBaseType O(2^D) diamond interface hierarchy - rails-0019: Digestor#dependency_digest Array#include? O(N²) cycle detection CLEAN: go, rustc (diamond recursion patterns absent)
1.5 KiB
1.5 KiB
go — CWE-407 Diamond Recursion Scan — CLEAN
Scanned: src/cmd/compile/internal/types2/ and src/go/types/
Functions Examined
| Function | File | Guard | Verdict |
|---|---|---|---|
computeInterfaceTypeSet |
typeset.go | ityp.tset != nil + sets sentinel before recursing |
CLEAN |
comparableType |
predicates.go | if seen[T] { return nil } before seen[T] = true |
CLEAN |
hasInvalidEmbeddedFields |
lookup.go | if S != nil && !seen[S] before seen[S] = true |
CLEAN |
tpWalker.isParameterized |
infer.go | if x, ok := w.seen[typ]; ok { return x } before set |
CLEAN |
cycleFinder.typ |
infer.go | if w.seen[typ] { return } before w.seen[typ] = true |
CLEAN |
findPath |
initorder.go | if seen[from] { return nil } before seen[from] = true |
CLEAN |
lookupFieldOrMethodImpl |
lookup.go | BFS with instanceLookup dedup |
CLEAN |
typestring writer |
typestring.go | if w.seen[typ] { return } before w.seen[typ] = true |
CLEAN |
Note
go/types is auto-generated from cmd/compile/internal/types2 — same source, same protections.
validType0 uses a nest []*Named slice for cycle detection (O(D) linear scan per node), not
a hash set — this is O(D²) in the worst case but does NOT produce exponential re-traversal on
diamond hierarchies because Go's named-type graph is a DAG of declared types. Spurious
re-visitation via the slice is bounded by path length, not by the exponential fanout of a diamond.
Scan verdict: CLEAN — no CWE-407 diamond recursion defects found.