java-topology/defects/go/patch/go-stdlib-deeper-CLEAN.md

UNDF: UNDF-2026-000000081

go-stdlib deeper scan — CLEAN

Scan date: 2026-03-27 Files scanned:

• src/net/http/header.go
• src/net/http/transport.go
• src/go/types/check.go
• src/cmd/link/internal/ld/deadcode.go

Findings

src/net/http/header.go — CLEAN

hasToken contains a single linear substring scan but is not called inside an outer loop. No O(n²) membership test pattern.

src/net/http/transport.go — CLEAN (assertion only)

tryPutIdleConn has a for-range dup check over idles:

for _, exist := range idles {
    if exist == pconn { log.Fatalf(...) }
}

This is a debug assertion guarding against internal invariant violation (log.Fatalf terminates the process). It is not a hot path — called once per completed HTTP request, not inside an outer loop over connections. The idles slice is also bounded by MaxIdleConnsPerHost (default 100), and the inner guard is O(100) per request event. Below CWE-407 threshold.

src/go/types/check.go — CLEAN

No linear slice membership tests inside loops. The type-checker uses maps for all deduplication. The existing go-0001 patch already covers tpWalker.isParameterized in src/cmd/compile/internal/types2/infer.go.

src/cmd/link/internal/ld/deadcode.go — CLEAN

d.ifaceMethod[m.m] and d.genericIfaceMethod[m.m.name] are map lookups O(1). The outer work-queue loop in flood() does not contain any linear slice membership tests; all set membership uses Go maps.

Conclusion

No new CWE-407 defects found in these four files beyond the previously patched go-stdlib-0001 (http2/rfc9218Priority) and go-0001 (types2/tpWalker).