russell@unturf.com
0b37443f11
spring-framework: 3 CWE-407 defects (UNDF-2026-000000734 through UNDF-2026-000000736)
spring-framework-0001 (UNDF-734): CorsConfiguration.checkHeaders() O(R×A)
- requestHeaders list (R) × allowedHeaders ArrayList (A) nested loop
- equalsIgnoreCase() scan per header — 14x measured at R=20, A=50
- Fix: build lowercase LinkedHashSet once O(A), lookup O(1) per header
spring-framework-0002 (UNDF-735): AcceptHeaderLocaleResolver O(R×S)
- Accept-Language locales (R) × supportedLocales ArrayList (S)
- per-request linear scan: 9x at R=15, S=20
- Same defect in AcceptHeaderLocaleContextResolver (reactive)
- Fix: LinkedHashSet for O(1) full-locale match
spring-framework-0003 (UNDF-736): EncodedResourceResolver.contentCodings O(A×C)
- acceptedCodings (A) × contentCodings ArrayList (C) per static resource request
- 8x at A=10, C=8
- Fix: LinkedHashSet for O(1) contains per accepted encoding
- Both spring-webmvc and spring-webflux variants
3/3 unit tests PASS