java-topology/docs/tickets/zulip-0001-clean.md

zulip-0001: CLEAN — no CWE-407 defects found

Target: zulip/zulip Severity: N/A Status: CLEAN

Summary

Scanned zerver/tornado/event_queue.py (message fanout / presence broadcast), zerver/actions/message_send.py (per-message UserMessage creation loop), and zerver/lib/alert_words.py (alert-word matching).

All hot-path membership tests use Python set / dict for O(1) lookup:

• process_message_event(): all user-ID sets (presence_idle_user_ids, online_push_user_ids, muted_sender_user_ids, etc.) are pre-built as set(event_template.get(..., [])) before the subscriber loop.
• message_send.py: mark_as_read_user_ids, mentioned_user_ids, ids_with_alert_words are all set[int] — O(1) per check.
• alert_words.py: uses ahocorasick.Automaton (Aho-Corasick) for multi-pattern matching — O(text_length) regardless of alert-word count.

No actionable CWE-407 defects identified.