russell@unturf.com
65c4a2c263
bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only gin: no new defects beyond gin-0001 (existing) fiber: no new defects beyond fiber-0001 (existing)
1.4 KiB
1.4 KiB
CWE-407 Scan — gorm (Go ORM)
Result: CLEAN Date: 2026-03-30 Repo: https://github.com/go-gorm/gorm (depth=1)
Scan Summary
Scanned gorm for O(N²) list membership patterns across: schema parsing, migrator, callbacks (query, preload, associations, create, update, delete), clause building, and utility functions.
Findings
No CWE-407 defects found.
Key paths examined
| Path | Pattern | Verdict |
|---|---|---|
migrator.ReorderModels() |
Dedup via orderedModelNamesMap = map[string]bool{} |
CLEAN |
schema/schema.go |
Field lookups via FieldsByName, FieldsByDBName maps |
CLEAN |
utils.Contains() |
Linear scan, but only called on small config slices (CreateClauses, etc.) | CLEAN |
callbacks/preload.go |
Identity maps using utils.ToStringKey() as map key |
CLEAN |
callbacks/associations.go |
cacheKey map for relationship value dedup |
CLEAN |
schema/field.go |
TagSettings map[string]string — O(1) tag lookup |
CLEAN |
Why gorm is clean
The migrator's topology sort (ReorderModels) uses a map[string]bool for
visited tracking — O(1) per lookup, O(V) total. Schema field and relationship
lookups use pre-built maps. The utils.Contains helper is only called on
small, configuration-time string slices (typically 1–3 elements: RETURNING clauses).
No accumulating visited-list inside an outer loop was found.