russell@unturf.com
068ebbd29f
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional CWE-407 defects. All repos found CLEAN beyond previously recorded patches. Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.
19 lines
575 B
Markdown
19 lines
575 B
Markdown
# CLEAN — Apache Thrift (Java)
|
|
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
|
|
|
|
## Scope
|
|
Library: lib/java/src — TBinaryProtocol, TCompactProtocol, TJSONProtocol, partial Thrift
|
|
comparer, service processor infrastructure.
|
|
|
|
## Findings
|
|
|
|
### partial/PartialThriftComparer — s2.contains()
|
|
`s2` is cast from parameter `Object o2` and the cast target is `Set<Object>`:
|
|
```java
|
|
Set<Object> s2 = (Set<Object>) o2;
|
|
if (!s2.contains(e1)) { ... }
|
|
```
|
|
O(1) set membership. Clean.
|
|
|
|
## Result
|
|
**CLEAN. No actionable CWE-407 defects found in Apache Thrift (Java library).**
|