2.2 KiB
ktor-0001: CWE-407 scan — CLEAN
| Field | Value |
|---|---|
| ID | ktor-0001 |
| Project | ktorio/ktor |
| Severity | CLEAN |
| Status | CLOSED (no defect) |
| CWE | CWE-407 (Algorithmic Complexity) |
| Found | 2026-03-27 |
Scope
Scanned:
ktor-server/ktor-server-core/common/src/(15 files)ktor-server/ktor-server-core/jvm/src/(6 files)ktor-server/ktor-server-plugins/(223 Kotlin source files)
Focus: List.contains(), listOf().contains(), in listOf() inside loops or per-request paths.
Findings
BaseApplicationRequest.kt:65,69 — CLEAN
removed: mutableSetOf<String>() and overridden: HeadersBuilder (backed by a map).
removed.contains(name) is O(1) HashSet lookup.
ResponseHeaders.kt:63 — CLEAN
managedByEngineHeaders: Set<String> — interface is Set. Concrete implementation
(ServletApplicationEngine) uses setOf(...) (LinkedHashSet) or emptySet(). O(1).
StaticContentResolution.kt:150 — CLEAN
pathComponents.contains("..") where pathComponents = path.split('/', '\\').
This is a one-shot safety check, not inside a loop. Not a hot path.
EmbeddedServerJvm.kt:468 — CLEAN
modules.contains(fqName) where modules = ArrayList(1) (capacity 1, used only during
startup module loading). Not a request-time hot path; startup only.
CORSUtils.kt:104 — CLEAN
corsCheckRequestHeaders iterates requestHeaders: List<String> and checks
header in allHeadersSet where allHeadersSet: Set<String> (built as .toSet() in CORS.kt:53).
The inner membership test is O(1). No defect.
CORS.kt:55,57 — CLEAN
it in CORSConfig.CorsSimpleRequestHeaders where CorsSimpleRequestHeaders is
CaseInsensitiveSet (a Set implementation). O(1).
CallId.kt:276 — CLEAN
verifyCallIdAgainstDictionary iterates a string's chars checking dictionarySet.contains(element)
where dictionarySet: Set<Char>. O(1) per lookup. The outer loop is O(|callId|), unavoidable.
Verdict
Ktor server-core and plugins are CLEAN for CWE-407. The codebase consistently uses Set,
HashSet, and CaseInsensitiveSet for membership tests on hot paths. No list-scan defects found.