24 lines
1.4 KiB
Markdown
24 lines
1.4 KiB
Markdown
# UNDF: UNDF-2026-000000352
|
|
# axum — CWE-407 Scan Result: CLEAN
|
|
|
|
**Date:** 2026-03-27
|
|
**Source:** https://github.com/tokio-rs/axum (depth=1)
|
|
**Scanned:** `axum/src/`, `axum-core/src/` (excluding test modules)
|
|
|
|
## Summary
|
|
|
|
No CWE-407 defects found in axum's production code paths.
|
|
|
|
## Candidates Evaluated
|
|
|
|
| Location | Pattern | Verdict |
|
|
|----------|---------|---------|
|
|
| `routing/method_routing.rs:885` | `endpoint_filter.contains(filter)` | **DISQUALIFIED** — `MethodFilter` is a bitflag struct; `.contains()` is bitwise AND, not a linear scan. |
|
|
| `routing/method_routing.rs:1233` | `s.contains(method)` in `append_allow_header` | **DISQUALIFIED** — `s` is a comma-separated Allow header string over at most ~9 HTTP methods (bounded constant). |
|
|
| `routing/path_router.rs:100` | `for endpoint in self.routes.iter_mut()` | **DISQUALIFIED** — iterates all routes once with no inner membership test; applies a transformation. |
|
|
| `extract/ws.rs:257` | `self.sec_websocket_protocol.contains(&proto)` | **DISQUALIFIED** — `sec_websocket_protocol` is a `BTreeSet<HeaderValue>`, not a Vec; O(log N) lookup. |
|
|
| `response/sse.rs:315,335,382,450` | `self.flags.contains(...)` | **DISQUALIFIED** — bitflag operations on `EventFlags`. |
|
|
|
|
## Conclusion
|
|
|
|
Axum's router uses `matchit` (radix trie) for path dispatch, `BTreeSet` for WebSocket protocol tracking, and bitflags for method filters. No unbounded linear membership tests found.
|