engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/flask/patch/CLEAN.md
russell@unturf.com 4d4c256673 diamond-scan: cpython/django O(2^D) hierarchy traversal; flask/rails/ruby/phoenix CLEAN 
cpython-0001: pydoc.allmethods unconditional __bases__ recursion, no visited guard
cpython-0002: turtle.__methodDict unconditional __bases__ recursion, fires at import
cpython-0003: idlelib.rpc._getmethods unconditional __bases__ recursion, IDLE debug path
django-0006: migrations.state.flatten_bases abstract model diamond traversal (comment in source acknowledges duplicates)
flask/rails/ruby/phoenix: CLEAN
2026-03-29 20:16:12 -04:00

640 B
Raw Blame History

Flask — CWE-407 Diamond Traversal Scan: CLEAN

Scanned: 2026-03-30

Files examined

  • src/flask/views.py — MethodView.__init_subclass__ iterates cls.__bases__ but does NOT recurse; one-level only
  • src/flask/sansio/app.py — exc_class.__mro__ iteration (linear, no recursion)
  • src/flask/blueprints.py — no class hierarchy traversal

Result

No diamond recursion defects found. Flask does not perform recursive __bases__ traversal. The __init_subclass__ hook in MethodView iterates one level of __bases__ to collect HTTP method names — this is O(B) where B is the number of direct bases, not recursive.