russell@unturf.com
068ebbd29f
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional CWE-407 defects. All repos found CLEAN beyond previously recorded patches. Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.
29 lines
1.3 KiB
Markdown
29 lines
1.3 KiB
Markdown
# CLEAN — Netty
|
||
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
|
||
|
||
## Scope
|
||
Modules scanned: common, handler (SSL/TLS), codec-http, codec-http2, transport.
|
||
|
||
## Findings
|
||
|
||
### handler/ssl/JdkBaseApplicationProtocolNegotiator — NoFailProtocolSelector.select()
|
||
`for (String p : supportedProtocols)` iterates a `Set<String>` (field declared as
|
||
`Set<String> supportedProtocols`) and calls `protocols.contains(p)` on a `List<String>`.
|
||
The outer set is O(S) where S = supported ALPN protocol count (typically 1–3); inner
|
||
list scan is O(P) where P = negotiated protocol count (also typically 1–3). Total O(S×P)
|
||
but bounded to small constants — not actionable.
|
||
|
||
### handler/ssl/JdkBaseApplicationProtocolNegotiator — NoFailProtocolSelectionListener.selected()
|
||
`supportedProtocols.contains(protocol)` — single call, not in a loop. Not a CWE-407 issue.
|
||
|
||
### handler/ssl/SslUtils.addIfSupported()
|
||
`supported.contains(n)` — `supported` is declared `Set<String>`. O(1). Clean.
|
||
|
||
### codec-http2/HttpConversionUtil — HTTP_TO_HTTP2_HEADER_BLACKLIST.contains()
|
||
Both `HTTP_TO_HTTP2_HEADER_BLACKLIST` and `connectionBlacklist` are `Set<AsciiString>` — O(1). Clean.
|
||
|
||
### transport/NioChannelOption — supportedOptions().contains()
|
||
Returns `Set<SocketOption<?>>` from the JDK. Clean.
|
||
|
||
## Result
|
||
**CLEAN. No actionable CWE-407 defects found in Netty.**
|