engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/tomcat/patch/tomcat-CLEAN-connectorandmapper.md

838 B
Raw Blame History

UNDF: UNDF-2026-000000315

Tomcat — CWE-407 scan result: CLEAN for connector/mapper/session (beyond tomcat-0002)

Files scanned:

  • java/org/apache/catalina/connector/CoyoteAdapter.java — getEffectiveSessionTrackingModes() returns Set<SessionTrackingMode> (EnumSet), O(1) contains. CLEAN.
  • java/org/apache/catalina/mapper/Mapper.java — removeWelcomeFile() linear scan is administrative (not per-request). CLEAN.
  • java/org/apache/catalina/session/ManagerBase.java — session storage uses ConcurrentHashMap, no linear membership tests in hot paths. CLEAN.
  • java/org/apache/catalina/filters/CorsFilter.java — allowedHttpMethods and allowedHttpHeaders are HashSet<String>, O(1) contains. CLEAN.

New defect tomcat-0002 found in java/org/apache/catalina/tribes/util/Arrays.merge() (separate patch file).