java-topology/docs/tickets/koa-0001-clean.md

1.4 KiB

Koa CWE-407 Scan — CLEAN

Project: Koa (koajs/koa) Scanned: lib/ (application.js, context.js, request.js, response.js, only.js, is-stream.js, search-params.js) Commit: depth-1 clone of https://github.com/koajs/koa Date: 2026-03-27 Result: CLEAN — no CWE-407 defects found

Methodology

Scanned all .js files under lib/ for Array.includes(), Array.indexOf(), Array.find(), and Array.findIndex() calls. Reviewed each hit in context.

Findings

Two hits found; neither is CWE-407:

request.js:262host.includes('@')

if (host.includes('@')) {

This is String.prototype.includes() on a single hostname string. Not an array membership test. Not inside any loop. Not CWE-407.

request.js:355methods.indexOf(this.method)

get idempotent () {
  const methods = ['GET', 'HEAD', 'PUT', 'DELETE', 'OPTIONS', 'TRACE']
  return !!~methods.indexOf(this.method)
},

methods is a fixed 6-element literal array defined inline. indexOf() on a constant-size array is O(6) = O(1) in practice. The getter is not called from inside any loop. Not CWE-407.

The correct fix for this getter would be a module-level Set (const IDEMPOTENT_METHODS = new Set([...]) + IDEMPOTENT_METHODS.has(this.method)) for clarity, but the O complexity difference is negligible (6 elements).

Verdict

Koa lib/ is CLEAN for CWE-407. No tickets created.