russell@unturf.com
068ebbd29f
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional CWE-407 defects. All repos found CLEAN beyond previously recorded patches. Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.
20 lines
743 B
Markdown
20 lines
743 B
Markdown
# CLEAN — Protocol Buffers (Java)
|
|
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
|
|
|
|
## Scope
|
|
Java library: java/core/src/main and java/util/src/main — Descriptors, DynamicMessage,
|
|
MessageLiteToString, JsonFormat, SchemaUtil, DescriptorMessageInfoFactory.
|
|
|
|
## Findings
|
|
|
|
### MessageLiteToString — setters.contains()
|
|
`setters` is `Set<String> setters = new HashSet<>()`. O(1). Clean.
|
|
|
|
### JsonFormat — includingDefaultValueFields.contains()
|
|
`includingDefaultValueFields` is `Set<FieldDescriptor>`. O(1). Clean.
|
|
|
|
### DescriptorMessageInfoFactory — specialFieldNames.contains()
|
|
`specialFieldNames` is a static `Set<String>`. O(1). Clean.
|
|
|
|
## Result
|
|
**CLEAN. No actionable CWE-407 defects found in Protocol Buffers Java library.**
|