29 lines
1.2 KiB
Text
29 lines
1.2 KiB
Text
kubo (Go IPFS implementation) — CLEAN across all 5 MOADs
|
|
|
|
Scanned: 2026-03-31
|
|
Source: ~/git/kubo (depth=1 clone from https://github.com/ipfs/kubo)
|
|
Files: 520 Go source files
|
|
|
|
MOAD-0001 (CWE-407): CLEAN
|
|
- cid.Set (hash-based) used for GC mark set, pin dedup, refs visited
|
|
- map[string]struct{} used for bootstrap dedup, address filter dedup, announce dedup
|
|
- map[string]int used for refs seen tracking
|
|
- slices.Contains only on fixed-size config lists (5 method names, 4 container inits)
|
|
- Nested loop in filtersRemove (swarm.go) is one-shot CLI config command, trivially small N
|
|
|
|
MOAD-0002 (Intertangle): No patchable defect
|
|
- IpfsNode is a large god object (30+ fields) but architectural, uses fx DI
|
|
|
|
MOAD-0003 (Leaked Context): CLEAN
|
|
- No context.WithValue abuse found
|
|
- Uses fx dependency injection for component wiring
|
|
|
|
MOAD-0004 (Logged Secret): CLEAN
|
|
- Swarm key fingerprint (hash) logged, not key itself
|
|
- API keys passed but never logged
|
|
- HTTPHeaders logged contain only CORS config
|
|
|
|
MOAD-0005 (Thundering Herd): CLEAN
|
|
- sync.Once for autoconf client singleton
|
|
- fx dependency injection for initialization
|
|
- No unsynchronized cache patterns
|