1.5 KiB
UNDF: UNDF-2026-000000802
Scribus — 5-MOAD Scan Result
Scanned: 2026-04-01 Clone: https://github.com/scribusproject/scribus (depth=1)
MOAD-0001 (CWE-407): 3 defects — PATCHED (scribus-0001/0002/0003)
- scribus-0001:
getSortedStyleList/getSortedCharStyleList/getSortedTableStyleList/getSortedCellStyleList—QList<int>::contains()inside O(S) loop → O(S²). Fix: companionQSet<int>for O(1) membership. - scribus-0002:
getUsedPatterns—results.contains()inside O(I×R) loop. - scribus-0003:
Selection::addItems—m_SelList.contains()inside O(N×M) loop.
MOAD-0002 (Intertangle): CLEAN
No shared mutable global god object coupling independent subsystems found.
ScribusApp and ScribusDoc are well-separated; document state is per-instance.
MOAD-0003 (Leaked Context): CLEAN
No thread_local or QThreadStorage holding request-scoped document identity found.
Document context is passed explicitly through function parameters and pointers.
MOAD-0004 (CWE-312): CLEAN
No network credential (password, auth token) logging found. Scribus does not include networking features that authenticate over HTTP/SMTP/LDAP; no logger calls adjacent to authentication credential handling were found.
MOAD-0005 (Thundering Herd): CLEAN
No concurrent cache get+null+compute+put without synchronization found.
ScImageCacheManager uses file-level locking (m_writeLockFile) rather than
in-memory unsynchronized cache patterns; no QCache or similar structure exposed
to concurrent write without lock.