russell@unturf.com
39981c70ad
Renumbering fixes (collisions with pre-existing IDs): - spring-0001-annotations-scanner → spring-0007 (spring-0001 was already assigned) - hibernate-0001-class-hierarchy-helper → hibernate-validator-0003 (wrong ecosystem/numbering) - django-0006-migrations-flatten-bases → django-0007 (django-0006 was already assigned) New diamond defects from agents that rate-limited before committing: - micronaut-0007: SuperclassAwareTypeVisitor.getInterfaces O(2^D) (new site) - quarkus-0005: ConfigMappingUtils.collectInterfacesRec O(2^D) (new site) - weld-0005: Services.identifyServiceInterfaces O(2^D) (new site) - typescript-0005: hasBaseType O(2^D) diamond interface hierarchy - rails-0019: Digestor#dependency_digest Array#include? O(N²) cycle detection CLEAN: go, rustc (diamond recursion patterns absent)
27 lines
1.5 KiB
Markdown
27 lines
1.5 KiB
Markdown
# go — CWE-407 Diamond Recursion Scan — CLEAN
|
|
|
|
Scanned: `src/cmd/compile/internal/types2/` and `src/go/types/`
|
|
|
|
## Functions Examined
|
|
|
|
| Function | File | Guard | Verdict |
|
|
|----------|------|-------|---------|
|
|
| `computeInterfaceTypeSet` | typeset.go | `ityp.tset != nil` + sets sentinel before recursing | CLEAN |
|
|
| `comparableType` | predicates.go | `if seen[T] { return nil }` before `seen[T] = true` | CLEAN |
|
|
| `hasInvalidEmbeddedFields` | lookup.go | `if S != nil && !seen[S]` before `seen[S] = true` | CLEAN |
|
|
| `tpWalker.isParameterized` | infer.go | `if x, ok := w.seen[typ]; ok { return x }` before set | CLEAN |
|
|
| `cycleFinder.typ` | infer.go | `if w.seen[typ] { return }` before `w.seen[typ] = true` | CLEAN |
|
|
| `findPath` | initorder.go | `if seen[from] { return nil }` before `seen[from] = true` | CLEAN |
|
|
| `lookupFieldOrMethodImpl` | lookup.go | BFS with `instanceLookup` dedup | CLEAN |
|
|
| `typestring writer` | typestring.go | `if w.seen[typ] { return }` before `w.seen[typ] = true` | CLEAN |
|
|
|
|
## Note
|
|
|
|
`go/types` is auto-generated from `cmd/compile/internal/types2` — same source, same protections.
|
|
|
|
`validType0` uses a `nest []*Named` slice for cycle detection (O(D) linear scan per node), not
|
|
a hash set — this is O(D²) in the worst case but does NOT produce exponential re-traversal on
|
|
diamond hierarchies because Go's named-type graph is a DAG of declared types. Spurious
|
|
re-visitation via the slice is bounded by path length, not by the exponential fanout of a diamond.
|
|
|
|
**Scan verdict: CLEAN — no CWE-407 diamond recursion defects found.**
|