1.5 KiB
1.5 KiB
signal-server-0001: CWE-407 scan — CLEAN
Target: signalapp/Signal-Server Scan date: 2026-03-27 Result: CLEAN
Summary
Full scan of service/src/main/java (1124 Java files) for CWE-407 patterns:
List.contains(), ArrayList.indexOf(), .stream().anyMatch() with linear
backing inside loops.
All hot-path membership checks use Set/HashSet/EnumSet:
| File | Pattern | Type | Verdict |
|---|---|---|---|
RemoteConfig.java |
getUuids().contains(uid) |
Set<UUID> |
CLEAN |
DynamicExperimentEnrollmentConfiguration.java |
getExcludedUuids().contains() |
Set<UUID> |
CLEAN |
DynamicE164ExperimentEnrollmentConfiguration.java |
getEnrolledE164s().contains() |
Set<String> |
CLEAN |
RemoteDeprecationFilter.java |
blockedVersionsByPlatform.get(...).contains() |
Set<Semver> |
CLEAN |
StripeManager.java / BraintreeManager.java |
getSupportedCurrenciesForPaymentMethod().contains() |
Set<String> |
CLEAN |
Util.java:329 |
indices.contains(i) inside loop |
HashSet<Integer> |
CLEAN |
Device.java:203 |
capabilities.contains(capability) |
EnumSet<DeviceCapability> |
CLEAN |
MessageSender.java:391-392 |
extraDeviceIds.contains() |
HashSet<Byte> |
CLEAN |
GrpcAllowListInterceptor.java:33-34 |
allowList.enabledServices().contains() |
Set<String> (interface) |
CLEAN |
Message delivery, session management, device registration, and group key distribution paths all use hash-backed sets. No O(n²) membership test found.