46 lines
1.4 KiB
Markdown
46 lines
1.4 KiB
Markdown
# Koa CWE-407 Scan — CLEAN
|
|
|
|
**Project:** Koa (`koajs/koa`)
|
|
**Scanned:** `lib/` (application.js, context.js, request.js, response.js, only.js, is-stream.js, search-params.js)
|
|
**Commit:** depth-1 clone of `https://github.com/koajs/koa`
|
|
**Date:** 2026-03-27
|
|
**Result:** CLEAN — no CWE-407 defects found
|
|
|
|
## Methodology
|
|
|
|
Scanned all `.js` files under `lib/` for `Array.includes()`, `Array.indexOf()`,
|
|
`Array.find()`, and `Array.findIndex()` calls. Reviewed each hit in context.
|
|
|
|
## Findings
|
|
|
|
Two hits found; neither is CWE-407:
|
|
|
|
### `request.js:262` — `host.includes('@')`
|
|
|
|
```javascript
|
|
if (host.includes('@')) {
|
|
```
|
|
|
|
This is `String.prototype.includes()` on a single hostname string. Not an array
|
|
membership test. Not inside any loop. Not CWE-407.
|
|
|
|
### `request.js:355` — `methods.indexOf(this.method)`
|
|
|
|
```javascript
|
|
get idempotent () {
|
|
const methods = ['GET', 'HEAD', 'PUT', 'DELETE', 'OPTIONS', 'TRACE']
|
|
return !!~methods.indexOf(this.method)
|
|
},
|
|
```
|
|
|
|
`methods` is a **fixed 6-element literal array** defined inline. `indexOf()` on
|
|
a constant-size array is O(6) = O(1) in practice. The getter is not called from
|
|
inside any loop. Not CWE-407.
|
|
|
|
The correct fix for this getter would be a module-level `Set` (`const
|
|
IDEMPOTENT_METHODS = new Set([...])` + `IDEMPOTENT_METHODS.has(this.method)`)
|
|
for clarity, but the O complexity difference is negligible (6 elements).
|
|
|
|
## Verdict
|
|
|
|
Koa `lib/` is **CLEAN** for CWE-407. No tickets created.
|