java-topology/defects/audacity/patch/audacity-SCAN-2026-03-31.md

UNDF: UNDF-2026-000001060

Audacity — Full 5-MOAD Scan 2026-03-31

Source: https://github.com/audacity/audacity (depth=1, HEAD ~2026-03)

MOAD-0001 (CWE-407) — 2 defects total (both pre-existing)

Pre-existing patches (audacity-0001, audacity-0002 already exist):

• 0001: TrackeditActionsController selectedTracks std::find in 7 track loop methods
• 0002: WaveTrack::CanOffsetClips() movingClips std::find in clip iteration loop

No new CWE-407 defects found in this scan pass.

Additional patterns reviewed and dismissed:

• au3/libraries/au3-registries/Registry.cpp:260 — InsertNewItemUsingPreferences calls std::find on saved preference ordering, but this runs once per plugin registration at startup, not in a hot per-frame/per-event loop. Not actionable.
• au3/libraries/au3-cloud-audiocom/TaskExecutionService.cpp:242 — mProcessedTasks capped at 100 items, single-threaded, not a scaling issue.
• au3/libraries/au3-effects/EffectOutputTracks.cpp:86 — GetMatchingInput scans mOMap once per effect application, not in an inner loop. Not actionable.

MOAD-0002 (Intertangle) — CLEAN

No single god-object equivalent to kdenlive's pCore found. Services are injected via muse::Inject dependency injection. Subsystems communicate through interfaces, not shared mutable global state.

MOAD-0003 (Leaked Context) — CLEAN

No thread_local or QThreadStorage variables found in src/. The au3 libraries use mutex-protected state (confirmed in recentfilescontroller.cpp where m_thumbnailCacheMutex is used correctly).

MOAD-0004 (CWE-312 Logged Secret) — CLEAN

OAuth implementation reviewed:

• au3cloud/internal/oauthhttpserverreplyhandler.cpp: LOGW() << "Invalid request: " << url fires when an unexpected path is received on the local callback server. The OAuth code and state params in the URL would only be logged if the path didn't match the registered callback path — which means normal OAuth flow is not logged. Low risk, error path only.
• au3cloud/internal/au3cloudservice.cpp: buildOAuthRequestURL includes client_secret in the URL but this is only passed to platformInteractive()->openUrl() (the system browser), never logged.
• No LOGD/LOGI calls found that output access_token or refresh_token.

MOAD-0005 (Thundering Herd) — CLEAN

src/project/internal/recentfilescontroller.cpp thumbnail cache uses m_thumbnailCacheMutex (std::mutex) correctly at every access site. No other cache get+null+compute+put patterns found without synchronization.