42 lines
1.6 KiB
Markdown
42 lines
1.6 KiB
Markdown
# UNDF: UNDF-2026-000000081
|
|
# go-stdlib deeper scan — CLEAN
|
|
|
|
**Scan date:** 2026-03-27
|
|
**Files scanned:**
|
|
- `src/net/http/header.go`
|
|
- `src/net/http/transport.go`
|
|
- `src/go/types/check.go`
|
|
- `src/cmd/link/internal/ld/deadcode.go`
|
|
|
|
## Findings
|
|
|
|
### `src/net/http/header.go` — CLEAN
|
|
`hasToken` contains a single linear substring scan but is not called inside
|
|
an outer loop. No O(n²) membership test pattern.
|
|
|
|
### `src/net/http/transport.go` — CLEAN (assertion only)
|
|
`tryPutIdleConn` has a for-range dup check over `idles`:
|
|
```go
|
|
for _, exist := range idles {
|
|
if exist == pconn { log.Fatalf(...) }
|
|
}
|
|
```
|
|
This is a debug assertion guarding against internal invariant violation
|
|
(`log.Fatalf` terminates the process). It is not a hot path — called once per
|
|
completed HTTP request, not inside an outer loop over connections. The `idles`
|
|
slice is also bounded by `MaxIdleConnsPerHost` (default 100), and the inner
|
|
guard is O(100) per request event. Below CWE-407 threshold.
|
|
|
|
### `src/go/types/check.go` — CLEAN
|
|
No linear slice membership tests inside loops. The type-checker uses maps for
|
|
all deduplication. The existing `go-0001` patch already covers
|
|
`tpWalker.isParameterized` in `src/cmd/compile/internal/types2/infer.go`.
|
|
|
|
### `src/cmd/link/internal/ld/deadcode.go` — CLEAN
|
|
`d.ifaceMethod[m.m]` and `d.genericIfaceMethod[m.m.name]` are map lookups O(1).
|
|
The outer work-queue loop in `flood()` does not contain any linear slice
|
|
membership tests; all set membership uses Go maps.
|
|
|
|
## Conclusion
|
|
No new CWE-407 defects found in these four files beyond the previously patched
|
|
`go-stdlib-0001` (http2/rfc9218Priority) and `go-0001` (types2/tpWalker).
|