java-topology/docs/tickets/ktor-0001-clean.md

55 lines
2.2 KiB
Markdown

# ktor-0001: CWE-407 scan — CLEAN
| Field | Value |
|-------------|-------|
| ID | ktor-0001 |
| Project | ktorio/ktor |
| Severity | CLEAN |
| Status | CLOSED (no defect) |
| CWE | CWE-407 (Algorithmic Complexity) |
| Found | 2026-03-27 |
## Scope
Scanned:
- `ktor-server/ktor-server-core/common/src/` (15 files)
- `ktor-server/ktor-server-core/jvm/src/` (6 files)
- `ktor-server/ktor-server-plugins/` (223 Kotlin source files)
Focus: `List.contains()`, `listOf().contains()`, `in listOf()` inside loops or per-request paths.
## Findings
### `BaseApplicationRequest.kt:65,69` — CLEAN
`removed: mutableSetOf<String>()` and `overridden: HeadersBuilder` (backed by a map).
`removed.contains(name)` is O(1) HashSet lookup.
### `ResponseHeaders.kt:63` — CLEAN
`managedByEngineHeaders: Set<String>` — interface is `Set`. Concrete implementation
(`ServletApplicationEngine`) uses `setOf(...)` (LinkedHashSet) or `emptySet()`. O(1).
### `StaticContentResolution.kt:150` — CLEAN
`pathComponents.contains("..")` where `pathComponents = path.split('/', '\\')`.
This is a one-shot safety check, not inside a loop. Not a hot path.
### `EmbeddedServerJvm.kt:468` — CLEAN
`modules.contains(fqName)` where `modules = ArrayList(1)` (capacity 1, used only during
startup module loading). Not a request-time hot path; startup only.
### `CORSUtils.kt:104` — CLEAN
`corsCheckRequestHeaders` iterates `requestHeaders: List<String>` and checks
`header in allHeadersSet` where `allHeadersSet: Set<String>` (built as `.toSet()` in CORS.kt:53).
The inner membership test is O(1). No defect.
### `CORS.kt:55,57` — CLEAN
`it in CORSConfig.CorsSimpleRequestHeaders` where `CorsSimpleRequestHeaders` is
`CaseInsensitiveSet` (a Set implementation). O(1).
### `CallId.kt:276` — CLEAN
`verifyCallIdAgainstDictionary` iterates a string's chars checking `dictionarySet.contains(element)`
where `dictionarySet: Set<Char>`. O(1) per lookup. The outer loop is O(|callId|), unavoidable.
## Verdict
Ktor server-core and plugins are **CLEAN** for CWE-407. The codebase consistently uses `Set`,
`HashSet`, and `CaseInsensitiveSet` for membership tests on hot paths. No list-scan defects found.