engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/odoo/CLEAN.md
russell@unturf.com 896a29f83b erp scan: erpnext-0001/0002, ofbiz-0001/0002; odoo CLEAN; 4/4 PASS 
erpnext-0001: BOM.get_children list dedup O(B^2) MEDIUM 4x
erpnext-0002: serial_batch_bundle serial/batch dedup O(N^2) HIGH 45x
ofbiz-0001: PaymentGatewayServices processList LinkedList O(N^2) HIGH 45x
ofbiz-0002: OrderReturnServices/OrderReadHelper payment dedup O(N^2) MEDIUM 36x
odoo: CLEAN (consistent set/frozenset/OrderedSet usage throughout)
2026-03-30 15:24:39 -04:00

995 B
Raw Permalink Blame History

Odoo — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30 Source: https://github.com/odoo/odoo (v19.0) Scanner: manual CWE-407 audit

Summary

No CWE-407 (algorithmic complexity via linear membership test in a loop) defects found.

Notes

Odoo's codebase is well-protected against this class of defect:

  • ORM core (odoo/orm/) uses set, frozenset, OrderedSet, and dict consistently for membership tests in loops
  • Recordsets implement set-based __contains__ (O(1))
  • tools/misc.py unique() helper uses set for dedup
  • Module loading uses dict/set for loaded module tracking
  • Record rules use SQL-based evaluation, not list scanning
  • Field dependency tracking uses Collector (dict of tuples) with small per-key sizes
  • Access control uses SQL queries, not list iteration

The Collector.add() method in tools/misc.py does if val not in vals on a tuple, but it is only called from field setup (not a hot loop) and tuple sizes are typically 1-3.