1.5 KiB
1.5 KiB
UNDF: UNDF-2026-000000469
Netty — CWE-407 Scan Result: CLEAN
Date: 2026-03-28 Repo: https://github.com/netty/netty (depth=1) Modules scanned: transport, codec, codec-http, codec-http2, codec-classes-quic, codec-mqtt, codec-smtp, handler (SSL/TLS), resolver-dns, common
Summary
No qualifying CWE-407 defects found in Netty.
Candidates reviewed and rejected
| Location | Pattern | Reason disqualified |
|---|---|---|
handler/ssl/JdkBaseApplicationProtocolNegotiator.java:146 |
for (p : supportedProtocols) { protocols.contains(p) } |
Both collections bounded to ≤4 ALPN protocol strings; trivial constant |
handler/ssl/SupportedCipherSuiteFilter.java:51 |
for (c : ciphers) { supportedCiphers.contains(c) } |
supportedCiphers is Set<String> — O(1) lookup |
resolver-dns/DnsNameResolverBuilder.java:568 |
for (f : searchDomains) { list.contains(f) } |
Search domain dedup; bounded ≤6 by RFC 1535 |
resolver-dns/DnsResolveContext.java:914 |
finalResult.contains(converted) |
Intentional ArrayList choice with code comment explaining the tradeoff; duplicates rare in practice |
codec-classes-quic/QuicCodecDispatcher.java:91 |
contextList.indexOf(ctxDispatcher) |
One-shot call after add, not in a loop |
Conclusion
Netty uses Set<String> for all cipher-suite and cipher-blacklist lookups, HashMap/CharSequenceMap for header tables, and purpose-built hash tables for HPACK. No O(N²) membership patterns in hot paths.