russell@unturf.com
7491349edc
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup per broadphase step — even carries "too slow" self-admission comment (HIGH) bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per frame on m_collisionDisabledObjects plain array (MEDIUM) allegro5: CLEAN (vector_contains only on non-hot setup paths) box2d: CLEAN (v3 rewrite uses b2HashSet throughout) dry: CLEAN (HashSet/HashMap on all hot dedup paths)
17 lines
650 B
Markdown
17 lines
650 B
Markdown
# synapse — CWE-407 Scan: CLEAN
|
|
|
|
Scanned: 2026-03-29
|
|
|
|
## Scope
|
|
|
|
- `synapse/push/mailer.py` — `deduped_ordered_list`: `seen = set()` (line 939)
|
|
- `synapse/storage/databases/main/event_push_actions.py` — `seen_thread_ids`: `set()` based
|
|
- Event DAG traversal / state resolution: checked state_resolution_v2.py, event_federation.py
|
|
- Room auth chain computation: uses set-based seen throughout
|
|
|
|
## Verdict
|
|
|
|
No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
|
|
All deduplication in push notification, event DAG traversal, and state
|
|
resolution uses `set` or `dict` structures. No list-based visited patterns in
|
|
hot paths.
|