java-topology/defects/httpx/CLEAN.md

httpx: CLEAN

CWE-407 scan: 2026-03-30

Source: https://github.com/encode/httpx (depth=1)

Scan scope

• httpx/ — 23 Python files
• Focus: header dedup, cookie jar membership, redirect chain dedup, transport pool membership, URL param dedup
• Keywords: in list, .index(, nested for loops

Findings

No CWE-407 defects found.

• Headers.__contains__ (line 346-348) creates a list and does linear scan — O(H) per call. Headers.update() calls if key in self in a loop — technically O(K*H), but HTTP headers are bounded (typically < 50) and this is a standard design for case-insensitive multidict.
• Headers.__setitem__ and __delitem__ also do linear scans over the internal list, but again bounded by header count.
• Redirect chain bounded by max_redirects (default 20)
• Cookie handling delegates to stdlib CookieJar
• QueryParams backed by dict — O(1) lookup

Verdict

CLEAN — all linear scans are on bounded collections (HTTP headers). No unbounded O(N^2) patterns.