35 lines
1.5 KiB
Markdown
35 lines
1.5 KiB
Markdown
# Scribus — 5-MOAD Scan Result
|
||
|
||
Scanned: 2026-04-01
|
||
Clone: https://github.com/scribusproject/scribus (depth=1)
|
||
|
||
## MOAD-0001 (CWE-407): 3 defects — PATCHED (scribus-0001/0002/0003)
|
||
|
||
- scribus-0001: `getSortedStyleList` / `getSortedCharStyleList` / `getSortedTableStyleList` /
|
||
`getSortedCellStyleList` — `QList<int>::contains()` inside O(S) loop → O(S²).
|
||
Fix: companion `QSet<int>` for O(1) membership.
|
||
- scribus-0002: `getUsedPatterns` — `results.contains()` inside O(I×R) loop.
|
||
- scribus-0003: `Selection::addItems` — `m_SelList.contains()` inside O(N×M) loop.
|
||
|
||
## MOAD-0002 (Intertangle): CLEAN
|
||
|
||
No shared mutable global god object coupling independent subsystems found.
|
||
`ScribusApp` and `ScribusDoc` are well-separated; document state is per-instance.
|
||
|
||
## MOAD-0003 (Leaked Context): CLEAN
|
||
|
||
No `thread_local` or `QThreadStorage` holding request-scoped document identity found.
|
||
Document context is passed explicitly through function parameters and pointers.
|
||
|
||
## MOAD-0004 (CWE-312): CLEAN
|
||
|
||
No network credential (password, auth token) logging found.
|
||
Scribus does not include networking features that authenticate over HTTP/SMTP/LDAP;
|
||
no logger calls adjacent to authentication credential handling were found.
|
||
|
||
## MOAD-0005 (Thundering Herd): CLEAN
|
||
|
||
No concurrent cache get+null+compute+put without synchronization found.
|
||
`ScImageCacheManager` uses file-level locking (`m_writeLockFile`) rather than
|
||
in-memory unsynchronized cache patterns; no `QCache` or similar structure exposed
|
||
to concurrent write without lock.
|