russell@unturf.com 65c4a2c263 bottle/gorm/axum/actix-web/gin/fiber: CWE-407 scan; 0 new defects, 4 CLEAN

bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict
gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps
axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains
actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only
gin: no new defects beyond gin-0001 (existing)
fiber: no new defects beyond fiber-0001 (existing)

2026-03-29 21:56:05 -04:00

1.6 KiB

Raw Permalink Blame History

CWE-407 Scan — actix-web (Rust web framework)

Result: CLEAN Date: 2026-03-30 Repo: https://github.com/actix/actix-web (depth=1)

Scan Summary

Scanned actix-web (actix-web, actix-http, actix-router) for O(N²) list membership patterns: Vec::contains in hot paths, visited/seen accumulation, linear dedup.

Findings

No CWE-407 defects found.

Key paths examined

Path	Pattern	Verdict
`middleware/logger.rs`	`exclude: HashSet<String>` — O(1) path exclusion per request	CLEAN
`http/header/accept_encoding.rs`	`supported_set: HashSet<_>` — O(1) encoding negotiation	CLEAN
`actix-http/src/requests/head.rs`	`Flags` bitflags — O(1)	CLEAN
`introspection.rs` `update_unique()`	`Vec::contains` but only called at route registration (startup), not per-request	CLEAN*
`actix-router/src/router.rs`	Linear scan over routes — O(R) per request, bounded, not O(N²)	CLEAN

*Note: introspection.rs update_unique<T> and externals.contains() call Vec::contains inside loops, but this only runs during application startup (route registration phase), not during request handling. The vectors hold HTTP method names and route pattern strings — typically O(10) elements. Not a runtime hot path.

Why actix-web is clean

Per-request hot paths use bitflags and HashSet for all membership tests. The one Vec::contains pattern in introspection.rs is confined to startup-time route registration and operates on vectors bounded by the number of HTTP methods (9) and route patterns defined by the user.

1.6 KiB Raw Permalink Blame History