russell@unturf.com
65c4a2c263
bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only gin: no new defects beyond gin-0001 (existing) fiber: no new defects beyond fiber-0001 (existing)
34 lines
1.4 KiB
Markdown
34 lines
1.4 KiB
Markdown
# CWE-407 Scan — gorm (Go ORM)
|
||
|
||
**Result: CLEAN**
|
||
**Date: 2026-03-30**
|
||
**Repo:** https://github.com/go-gorm/gorm (depth=1)
|
||
|
||
## Scan Summary
|
||
|
||
Scanned gorm for O(N²) list membership patterns across: schema parsing, migrator,
|
||
callbacks (query, preload, associations, create, update, delete), clause building,
|
||
and utility functions.
|
||
|
||
## Findings
|
||
|
||
No CWE-407 defects found.
|
||
|
||
### Key paths examined
|
||
|
||
| Path | Pattern | Verdict |
|
||
|------|---------|---------|
|
||
| `migrator.ReorderModels()` | Dedup via `orderedModelNamesMap = map[string]bool{}` | CLEAN |
|
||
| `schema/schema.go` | Field lookups via `FieldsByName`, `FieldsByDBName` maps | CLEAN |
|
||
| `utils.Contains()` | Linear scan, but only called on small config slices (CreateClauses, etc.) | CLEAN |
|
||
| `callbacks/preload.go` | Identity maps using `utils.ToStringKey()` as map key | CLEAN |
|
||
| `callbacks/associations.go` | `cacheKey` map for relationship value dedup | CLEAN |
|
||
| `schema/field.go` | `TagSettings map[string]string` — O(1) tag lookup | CLEAN |
|
||
|
||
### Why gorm is clean
|
||
|
||
The migrator's topology sort (`ReorderModels`) uses a `map[string]bool` for
|
||
visited tracking — O(1) per lookup, O(V) total. Schema field and relationship
|
||
lookups use pre-built maps. The `utils.Contains` helper is only called on
|
||
small, configuration-time string slices (typically 1–3 elements: RETURNING clauses).
|
||
No accumulating visited-list inside an outer loop was found.
|