47 lines
2 KiB
Markdown
47 lines
2 KiB
Markdown
# Nim — CWE-407 Diamond Recursion Scan: CLEAN
|
||
|
||
## Scan Date
|
||
2026-03-29
|
||
|
||
## Targets Checked
|
||
|
||
### 1. Object type inheritance (`isObjectSubtype`, `sigmatch.nim`)
|
||
- **File:** `compiler/sigmatch.nim`, lines 619–636
|
||
- **Mechanism:** Single-inheritance `while t != nil: t = t.baseClass` chain.
|
||
Nim objects have exactly one parent — no diamond possible.
|
||
- **Result:** CLEAN (single-parent chain, O(D) linear).
|
||
|
||
### 2. Concept matching (`concepts.nim`)
|
||
- **File:** `compiler/concepts.nim`
|
||
- **Guard:** `MatchCon` carries `marker: initHashSet[ConceptTypePair]()` —
|
||
used to prevent infinite recursion in mutual-concept matching.
|
||
- **`conceptsMatch`:** Compares concept bodies structurally; `processConcept`
|
||
uses the HashSet marker for cycle detection.
|
||
- **Result:** CLEAN — HashSet visited guard present.
|
||
|
||
### 3. Module dependency tracking (`deps.nim`)
|
||
- **File:** `compiler/deps.nim`, lines 282–286
|
||
- **Guard:** `seenFiles = initHashSet[string]()` with `containsOrIncl`.
|
||
- **Result:** CLEAN.
|
||
|
||
### 4. Type traversal in `types.nim`
|
||
- **File:** `compiler/types.nim`, line 1352
|
||
- Uses `seen = initIntSet()` with `containsOrIncl(seen, result.id)` for type
|
||
alias chain traversal.
|
||
- **Result:** CLEAN.
|
||
|
||
### 5. AST cycle detection (`trees.nim`)
|
||
- **File:** `compiler/trees.nim`, `cyclicTreeAux`
|
||
- Uses `visited: seq[PNode]` (a stack, not a set) with linear `for v in visited: if v == n`
|
||
check — O(V) per node, O(V²) total.
|
||
- **However:** This is DFS stack semantics (push on enter, pop on exit), correct for
|
||
cycle detection in trees. `cyclicTree` is only called from `vm.nim` after macro
|
||
expansion to validate the output — not in a hot compilation path.
|
||
- N is bounded by macro output AST size, not by type hierarchy depth. Not a diamond
|
||
recursion issue.
|
||
- **Result:** Not CWE-407 (bounded, correct algorithm for stack-based DFS).
|
||
|
||
## Conclusion
|
||
|
||
No CWE-407 diamond recursion defects found in Nim. Object inheritance is single-parent;
|
||
concept matching uses a HashSet guard; module dependency tracking uses a HashSet.
|