24 lines
1.5 KiB
Markdown
24 lines
1.5 KiB
Markdown
# UNDF: UNDF-2026-000000469
|
|
# Netty — CWE-407 Scan Result: CLEAN
|
|
|
|
**Date:** 2026-03-28
|
|
**Repo:** https://github.com/netty/netty (depth=1)
|
|
**Modules scanned:** transport, codec, codec-http, codec-http2, codec-classes-quic, codec-mqtt, codec-smtp, handler (SSL/TLS), resolver-dns, common
|
|
|
|
## Summary
|
|
|
|
No qualifying CWE-407 defects found in Netty.
|
|
|
|
## Candidates reviewed and rejected
|
|
|
|
| Location | Pattern | Reason disqualified |
|
|
|---|---|---|
|
|
| `handler/ssl/JdkBaseApplicationProtocolNegotiator.java:146` | `for (p : supportedProtocols) { protocols.contains(p) }` | Both collections bounded to ≤4 ALPN protocol strings; trivial constant |
|
|
| `handler/ssl/SupportedCipherSuiteFilter.java:51` | `for (c : ciphers) { supportedCiphers.contains(c) }` | `supportedCiphers` is `Set<String>` — O(1) lookup |
|
|
| `resolver-dns/DnsNameResolverBuilder.java:568` | `for (f : searchDomains) { list.contains(f) }` | Search domain dedup; bounded ≤6 by RFC 1535 |
|
|
| `resolver-dns/DnsResolveContext.java:914` | `finalResult.contains(converted)` | Intentional ArrayList choice with code comment explaining the tradeoff; duplicates rare in practice |
|
|
| `codec-classes-quic/QuicCodecDispatcher.java:91` | `contextList.indexOf(ctxDispatcher)` | One-shot call after `add`, not in a loop |
|
|
|
|
## Conclusion
|
|
|
|
Netty uses `Set<String>` for all cipher-suite and cipher-blacklist lookups, `HashMap`/`CharSequenceMap` for header tables, and purpose-built hash tables for HPACK. No O(N²) membership patterns in hot paths.
|