russell@unturf.com
a629bd0bbf
New defects (all PASS): - exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20 - minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24 - minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N) - minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N) - minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N) - mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000 - ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x - pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup, prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools, linux-kernel (pointer to linux/)
34 lines
1.5 KiB
Markdown
34 lines
1.5 KiB
Markdown
# Koa CWE-407 Scan — CLEAN
|
|
|
|
**Scan date:** 2026-03-29
|
|
|
|
## Files scanned
|
|
|
|
- `lib/application.js` — middleware composition, request dispatch
|
|
- `lib/context.js` — context prototype, error handling
|
|
- `lib/request.js` — request parsing helpers
|
|
- `lib/response.js` — response helpers
|
|
- `lib/is-stream.js` — stream type check
|
|
- `lib/only.js` — object key filter
|
|
- `lib/search-params.js` — URL search param helpers
|
|
|
|
## Findings
|
|
|
|
- `lib/request.js:262` — `host.includes('@')` — single O(N) check on a hostname
|
|
string, not inside any loop.
|
|
- `lib/request.js:355` — `methods.indexOf(this.method)` — checks membership in a
|
|
6-element constant array `['GET','HEAD','PUT','DELETE','OPTIONS','TRACE']`.
|
|
Called once per `idempotent` getter access. Fixed-size array (O(6) = O(1) in
|
|
practice). No outer loop; a `Set` would be marginally faster but the array is
|
|
too small to exhibit O(N²) behaviour in any realistic traffic pattern. Not a
|
|
CWE-407 defect; noted as a minor allocation smell (new array per call).
|
|
- `lib/application.js` — middleware array is a plain push-only array; dispatch via
|
|
`koa-compose` iterates it sequentially with no membership checks.
|
|
- `lib/context.js` — `res.getHeaderNames().forEach(...)` in `onerror` is bounded by
|
|
the number of response headers (not nested).
|
|
|
|
## Conclusion
|
|
|
|
No CWE-407 defects found in Koa. The `methods.indexOf` at line 355 is a fixed
|
|
O(6) scan on a constant 6-element array — below any practical threshold and not
|
|
nested in a hot loop. All other membership-style calls are single-pass helpers.
|