1.9 KiB
1.9 KiB
UNDF: UNDF-2026-000000295
Spring Framework — Deeper CWE-407 Scan CLEAN Report
Scan Date
2026-03-27
Areas Scanned (beyond spring-0001 through spring-0006)
| Area | Files Scanned | Finding |
|---|---|---|
spring-aop AdvisedSupport.addInterface() |
ArrayList.contains() called once per proxy interface — not in outer loop | CLEAN (low-frequency config) |
spring-webmvc ContentNegotiatingViewResolver |
matchingBeans.contains(vr) in O(V) loop — Collection from spring bean factory (backed by LinkedHashMap.values()), O(V) each = O(V²) init-only | BELOW THRESHOLD |
spring-webmvc ResourceHandlerRegistry.hasMappingForPattern() |
Arrays.asList(array).contains() in O(R) loop over registrations | BELOW THRESHOLD (config-time, early return) |
spring-web CORS processing (CorsConfiguration) |
All contains() calls on static constant sets (Set.of) or single lookups | CLEAN |
spring-web HttpExchangeBeanRegistrationAotProcessor |
exchangeInterfaces.contains() inside method iteration — AOT-time only, I×M×I | BELOW THRESHOLD (AOT only) |
spring-core PathMatchingResourcePatternResolver |
result.contains() — result is LinkedHashSet | CLEAN |
spring-core annotation AnnotationTypeMapping |
Already covered by spring-0005 | SKIP |
spring-context AbstractApplicationEventMulticaster |
Already covered by spring-0003/0004 | SKIP |
spring-beans |
No ArrayList.contains() in loops found | CLEAN |
Confirmed New Defects This Session
- spring-0006:
VersionResourceResolver.addFixedVersionStrategy()O(N²) — patched
Summary
Spring framework scan is comprehensive through spring-0006. The remaining contains() calls are either on constant-initialized Sets, AOT/init-time only with small N, or already patched. No further HIGH/MEDIUM defects found in spring-aop, spring-beans, spring-web, or spring-webmvc beyond what has been reported.