java-topology/defects/grpc/patch/CLEAN.md

CLEAN — gRPC (multi-language)

Scanned 2026-03-29 for CWE-407.

Scope

• Java source: examples/android/helloworld/ only (no Java RPC core in this clone)
• C++ core: core/lib/, src/core/ — service resolution, call handling

Findings

gRPC's Java implementation in this repository is limited to example code. The core RPC runtime is implemented in C++ and uses protobuf-generated descriptors with flat-array or hash-map lookups for service and method resolution. No quadratic list-membership pattern was found in:

• Method descriptor building (protobuf ServiceDescriptor uses array indexing)
• Service type resolution (registry uses hash map)
• Call filter/interceptor chains (fixed-size arrays assembled at startup)

Result: No actionable CWE-407 defects.