1.4 KiB
Koa CWE-407 Scan — CLEAN
Project: Koa (koajs/koa)
Scanned: lib/ (application.js, context.js, request.js, response.js, only.js, is-stream.js, search-params.js)
Commit: depth-1 clone of https://github.com/koajs/koa
Date: 2026-03-27
Result: CLEAN — no CWE-407 defects found
Methodology
Scanned all .js files under lib/ for Array.includes(), Array.indexOf(),
Array.find(), and Array.findIndex() calls. Reviewed each hit in context.
Findings
Two hits found; neither is CWE-407:
request.js:262 — host.includes('@')
if (host.includes('@')) {
This is String.prototype.includes() on a single hostname string. Not an array
membership test. Not inside any loop. Not CWE-407.
request.js:355 — methods.indexOf(this.method)
get idempotent () {
const methods = ['GET', 'HEAD', 'PUT', 'DELETE', 'OPTIONS', 'TRACE']
return !!~methods.indexOf(this.method)
},
methods is a fixed 6-element literal array defined inline. indexOf() on
a constant-size array is O(6) = O(1) in practice. The getter is not called from
inside any loop. Not CWE-407.
The correct fix for this getter would be a module-level Set (const IDEMPOTENT_METHODS = new Set([...]) + IDEMPOTENT_METHODS.has(this.method))
for clarity, but the O complexity difference is negligible (6 elements).
Verdict
Koa lib/ is CLEAN for CWE-407. No tickets created.