russell@unturf.com 068ebbd29f cpp-systems: tor CLEAN.md updated to note existing patches tor-0001/0002/0003

Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional
CWE-407 defects. All repos found CLEAN beyond previously recorded patches.
Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.

2026-03-29 19:54:59 -04:00

743 B

Raw Blame History

CLEAN — Protocol Buffers (Java)

Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

Scope

Java library: java/core/src/main and java/util/src/main — Descriptors, DynamicMessage, MessageLiteToString, JsonFormat, SchemaUtil, DescriptorMessageInfoFactory.

Findings

MessageLiteToString — setters.contains()

setters is Set<String> setters = new HashSet<>(). O(1). Clean.

JsonFormat — includingDefaultValueFields.contains()

includingDefaultValueFields is Set<FieldDescriptor>. O(1). Clean.

DescriptorMessageInfoFactory — specialFieldNames.contains()

specialFieldNames is a static Set<String>. O(1). Clean.

Result

CLEAN. No actionable CWE-407 defects found in Protocol Buffers Java library.

743 B Raw Blame History