24 lines
1.1 KiB
Markdown
24 lines
1.1 KiB
Markdown
# Nextcloud Server — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned: 2026-03-30
|
|
Target: https://github.com/nextcloud/server (PHP)
|
|
Focus: lib/private/, apps/ — sharing, file operations, CalDAV, contacts, app management, encryption, LDAP
|
|
|
|
## Summary
|
|
|
|
No CWE-407 defects found. Nextcloud uses PHP associative arrays (hash maps) for most
|
|
hot-path membership tests. The `in_array()` calls found (386 total, 62 inside foreach
|
|
loops) all operate on:
|
|
|
|
- Constant-size field/property arrays (< 15 elements)
|
|
- Config-level lists bounded by application count (< 100)
|
|
- Early-exit search patterns with small search spaces
|
|
- Error/logging paths not on hot execution path
|
|
|
|
## Notable non-defects reviewed
|
|
|
|
- `lib/private/AppConfig.php` strictnessApplied dedup — logging path only
|
|
- `lib/private/Collaboration/Collaborators/GroupPlugin.php` — bounded by $limit parameter
|
|
- `lib/private/Log/ExceptionSerializer.php` removeValuesFromArgs — error path only
|
|
- `apps/files_external/lib/Lib/ApplicableHelper.php` diffApplicable — config-level groups/users
|
|
- `lib/private/Files/Cache/Cache.php` normalizeData — constant-size field arrays
|