23 lines
937 B
Markdown
23 lines
937 B
Markdown
# zulip-0001: CLEAN — no CWE-407 defects found
|
|
|
|
**Target:** zulip/zulip
|
|
**Severity:** N/A
|
|
**Status:** CLEAN
|
|
|
|
## Summary
|
|
|
|
Scanned `zerver/tornado/event_queue.py` (message fanout / presence broadcast),
|
|
`zerver/actions/message_send.py` (per-message UserMessage creation loop), and
|
|
`zerver/lib/alert_words.py` (alert-word matching).
|
|
|
|
All hot-path membership tests use Python `set` / `dict` for O(1) lookup:
|
|
|
|
- `process_message_event()`: all user-ID sets (`presence_idle_user_ids`,
|
|
`online_push_user_ids`, `muted_sender_user_ids`, etc.) are pre-built as
|
|
`set(event_template.get(..., []))` before the subscriber loop.
|
|
- `message_send.py`: `mark_as_read_user_ids`, `mentioned_user_ids`,
|
|
`ids_with_alert_words` are all `set[int]` — O(1) per check.
|
|
- `alert_words.py`: uses `ahocorasick.Automaton` (Aho-Corasick) for
|
|
multi-pattern matching — O(text_length) regardless of alert-word count.
|
|
|
|
No actionable CWE-407 defects identified.
|