java-topology/defects/nextcloud-server/patch/CLEAN.md

Nextcloud Server — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30 Target: https://github.com/nextcloud/server (PHP) Focus: lib/private/, apps/ — sharing, file operations, CalDAV, contacts, app management, encryption, LDAP

Summary

No CWE-407 defects found. Nextcloud uses PHP associative arrays (hash maps) for most hot-path membership tests. The in_array() calls found (386 total, 62 inside foreach loops) all operate on:

• Constant-size field/property arrays (< 15 elements)
• Config-level lists bounded by application count (< 100)
• Early-exit search patterns with small search spaces
• Error/logging paths not on hot execution path

Notable non-defects reviewed

• lib/private/AppConfig.php strictnessApplied dedup — logging path only
• lib/private/Collaboration/Collaborators/GroupPlugin.php — bounded by $limit parameter
• lib/private/Log/ExceptionSerializer.php removeValuesFromArgs — error path only
• apps/files_external/lib/Lib/ApplicableHelper.php diffApplicable — config-level groups/users
• lib/private/Files/Cache/Cache.php normalizeData — constant-size field arrays