russell@unturf.com
52a8d535a2
dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238) cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237) Struts, RabbitMQ, Camel: CLEAN
28 lines
1.3 KiB
Markdown
28 lines
1.3 KiB
Markdown
# Apache Struts — CWE-407 Scan Result: CLEAN
|
|
|
|
## Scan Date: 2026-03-29
|
|
|
|
## Method Scanned
|
|
Searched `core/` for recursive traversal of interceptor/action dependency graphs without
|
|
visited sets.
|
|
|
|
## Findings
|
|
|
|
### ActionChainResult — action chain cycle detection
|
|
`ActionChainResult` uses a `LinkedList<String>` chain history stored in `ActionContext` as
|
|
the cycle guard. The chain is appended on each hop; an `IllegalArgumentException` is thrown
|
|
if the action name is already in the chain (infinite recursion guard). This is O(N) list
|
|
membership per hop for N chain steps — acceptable for short action chains (typically 1-3
|
|
deep in practice, bounded by configuration). Not a hot path in production traffic.
|
|
|
|
### InterceptorBuilder.constructParameterizedInterceptorReferences
|
|
The recursive call here resolves nested interceptor-stack parameter names. Recursion is
|
|
driven by dotted-param keys (`stack1.interceptor1.param`) that are consumed at each level —
|
|
no shared DAG is traversed. Termination is guaranteed by the param key prefix being stripped
|
|
on each level. No visited guard needed; not CWE-407.
|
|
|
|
### InterceptorStackConfig.getInterceptors
|
|
Returns a pre-built flat `List<InterceptorMapping>` — no recursive graph traversal at runtime.
|
|
|
|
## Conclusion
|
|
CLEAN. No CWE-407 defects found in Apache Struts.
|