russell@unturf.com 068ebbd29f cpp-systems: tor CLEAN.md updated to note existing patches tor-0001/0002/0003

Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional
CWE-407 defects. All repos found CLEAN beyond previously recorded patches.
Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.

2026-03-29 19:54:59 -04:00

1.3 KiB

Raw Blame History

CLEAN — Netty

Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

Scope

Modules scanned: common, handler (SSL/TLS), codec-http, codec-http2, transport.

Findings

handler/ssl/JdkBaseApplicationProtocolNegotiator — NoFailProtocolSelector.select()

for (String p : supportedProtocols) iterates a Set<String> (field declared as Set<String> supportedProtocols) and calls protocols.contains(p) on a List<String>. The outer set is O(S) where S = supported ALPN protocol count (typically 1–3); inner list scan is O(P) where P = negotiated protocol count (also typically 1–3). Total O(S×P) but bounded to small constants — not actionable.

handler/ssl/JdkBaseApplicationProtocolNegotiator — NoFailProtocolSelectionListener.selected()

supportedProtocols.contains(protocol) — single call, not in a loop. Not a CWE-407 issue.

handler/ssl/SslUtils.addIfSupported()

supported.contains(n) — supported is declared Set<String>. O(1). Clean.

codec-http2/HttpConversionUtil — HTTP_TO_HTTP2_HEADER_BLACKLIST.contains()

Both HTTP_TO_HTTP2_HEADER_BLACKLIST and connectionBlacklist are Set<AsciiString> — O(1). Clean.

transport/NioChannelOption — supportedOptions().contains()

Returns Set<SocketOption<?>> from the JDK. Clean.

Result

CLEAN. No actionable CWE-407 defects found in Netty.

1.3 KiB Raw Blame History Unescape Escape