55 lines
2.2 KiB
Markdown
55 lines
2.2 KiB
Markdown
# ktor-0001: CWE-407 scan — CLEAN
|
|
|
|
| Field | Value |
|
|
|-------------|-------|
|
|
| ID | ktor-0001 |
|
|
| Project | ktorio/ktor |
|
|
| Severity | CLEAN |
|
|
| Status | CLOSED (no defect) |
|
|
| CWE | CWE-407 (Algorithmic Complexity) |
|
|
| Found | 2026-03-27 |
|
|
|
|
## Scope
|
|
|
|
Scanned:
|
|
- `ktor-server/ktor-server-core/common/src/` (15 files)
|
|
- `ktor-server/ktor-server-core/jvm/src/` (6 files)
|
|
- `ktor-server/ktor-server-plugins/` (223 Kotlin source files)
|
|
|
|
Focus: `List.contains()`, `listOf().contains()`, `in listOf()` inside loops or per-request paths.
|
|
|
|
## Findings
|
|
|
|
### `BaseApplicationRequest.kt:65,69` — CLEAN
|
|
`removed: mutableSetOf<String>()` and `overridden: HeadersBuilder` (backed by a map).
|
|
`removed.contains(name)` is O(1) HashSet lookup.
|
|
|
|
### `ResponseHeaders.kt:63` — CLEAN
|
|
`managedByEngineHeaders: Set<String>` — interface is `Set`. Concrete implementation
|
|
(`ServletApplicationEngine`) uses `setOf(...)` (LinkedHashSet) or `emptySet()`. O(1).
|
|
|
|
### `StaticContentResolution.kt:150` — CLEAN
|
|
`pathComponents.contains("..")` where `pathComponents = path.split('/', '\\')`.
|
|
This is a one-shot safety check, not inside a loop. Not a hot path.
|
|
|
|
### `EmbeddedServerJvm.kt:468` — CLEAN
|
|
`modules.contains(fqName)` where `modules = ArrayList(1)` (capacity 1, used only during
|
|
startup module loading). Not a request-time hot path; startup only.
|
|
|
|
### `CORSUtils.kt:104` — CLEAN
|
|
`corsCheckRequestHeaders` iterates `requestHeaders: List<String>` and checks
|
|
`header in allHeadersSet` where `allHeadersSet: Set<String>` (built as `.toSet()` in CORS.kt:53).
|
|
The inner membership test is O(1). No defect.
|
|
|
|
### `CORS.kt:55,57` — CLEAN
|
|
`it in CORSConfig.CorsSimpleRequestHeaders` where `CorsSimpleRequestHeaders` is
|
|
`CaseInsensitiveSet` (a Set implementation). O(1).
|
|
|
|
### `CallId.kt:276` — CLEAN
|
|
`verifyCallIdAgainstDictionary` iterates a string's chars checking `dictionarySet.contains(element)`
|
|
where `dictionarySet: Set<Char>`. O(1) per lookup. The outer loop is O(|callId|), unavoidable.
|
|
|
|
## Verdict
|
|
|
|
Ktor server-core and plugins are **CLEAN** for CWE-407. The codebase consistently uses `Set`,
|
|
`HashSet`, and `CaseInsensitiveSet` for membership tests on hot paths. No list-scan defects found.
|