28 lines
1.9 KiB
Markdown
28 lines
1.9 KiB
Markdown
# UNDF: UNDF-2026-000000295
|
||
# Spring Framework — Deeper CWE-407 Scan CLEAN Report
|
||
|
||
## Scan Date
|
||
2026-03-27
|
||
|
||
## Areas Scanned (beyond spring-0001 through spring-0006)
|
||
|
||
| Area | Files Scanned | Finding |
|
||
|------|---------------|---------|
|
||
| `spring-aop` AdvisedSupport.addInterface() | ArrayList.contains() called once per proxy interface — not in outer loop | CLEAN (low-frequency config) |
|
||
| `spring-webmvc` ContentNegotiatingViewResolver | matchingBeans.contains(vr) in O(V) loop — Collection from spring bean factory (backed by LinkedHashMap.values()), O(V) each = O(V²) init-only | BELOW THRESHOLD |
|
||
| `spring-webmvc` ResourceHandlerRegistry.hasMappingForPattern() | Arrays.asList(array).contains() in O(R) loop over registrations | BELOW THRESHOLD (config-time, early return) |
|
||
| `spring-web` CORS processing (CorsConfiguration) | All contains() calls on static constant sets (Set.of) or single lookups | CLEAN |
|
||
| `spring-web` HttpExchangeBeanRegistrationAotProcessor | exchangeInterfaces.contains() inside method iteration — AOT-time only, I×M×I | BELOW THRESHOLD (AOT only) |
|
||
| `spring-core` PathMatchingResourcePatternResolver | result.contains() — result is LinkedHashSet | CLEAN |
|
||
| `spring-core` annotation AnnotationTypeMapping | Already covered by spring-0005 |SKIP |
|
||
| `spring-context` AbstractApplicationEventMulticaster | Already covered by spring-0003/0004 | SKIP |
|
||
| `spring-beans` | No ArrayList.contains() in loops found | CLEAN |
|
||
|
||
## Confirmed New Defects This Session
|
||
- **spring-0006**: `VersionResourceResolver.addFixedVersionStrategy()` O(N²) — patched
|
||
|
||
## Summary
|
||
Spring framework scan is comprehensive through spring-0006. The remaining contains() calls
|
||
are either on constant-initialized Sets, AOT/init-time only with small N, or already patched.
|
||
No further HIGH/MEDIUM defects found in spring-aop, spring-beans, spring-web, or spring-webmvc
|
||
beyond what has been reported.
|