russell@unturf.com 65c4a2c263 bottle/gorm/axum/actix-web/gin/fiber: CWE-407 scan; 0 new defects, 4 CLEAN

bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict
gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps
axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains
actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only
gin: no new defects beyond gin-0001 (existing)
fiber: no new defects beyond fiber-0001 (existing)

2026-03-29 21:56:05 -04:00

1.2 KiB

Raw Blame History

CWE-407 Scan — axum (Rust web framework)

Result: CLEAN Date: 2026-03-30 Repo: https://github.com/tokio-rs/axum (depth=1)

Scan Summary

Scanned axum (axum, axum-core, axum-extra, axum-macros) for O(N²) list membership patterns: Vec::contains in loops, visited/seen accumulation, linear dedup.

Findings

No CWE-407 defects found.

Key paths examined

Path	Pattern	Verdict
`routing/method_filter.rs`	`MethodFilter` is a `u16` bitmask — `contains()` is O(1) bitwise AND	CLEAN
`extract/ws.rs`	`sec_websocket_protocol: BTreeSet<HeaderValue>` — O(log N)	CLEAN
`routing/method_routing.rs:885`	`endpoint_filter.contains(filter)` — bitmask, O(1)	CLEAN
`response/sse.rs`	`EventFlags` bitflags — O(1)	CLEAN
`axum-extra/routing/typed.rs`	`String::contains('?')` — substring check, not collection	CLEAN

Why axum is clean

Axum uses bitmask flags (MethodFilter, EventFlags) for all method/flag membership checks — O(1). WebSocket protocol set uses BTreeSet (O(log N)). No Vec::contains call in a hot per-request path was found. The framework follows idiomatic Rust conventions throughout.

1.2 KiB Raw Blame History