engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/express/patch/express-CLEAN.md
russell@unturf.com a629bd0bbf no-stone-unturned wave: 8 new defects, 15 CLEAN confirmations; count 621→629 
New defects (all PASS):
- exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20
- minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24
- minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N)
- minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N)
- minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N)
- mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000
- ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x
- pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x

CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup,
  prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools,
  linux-kernel (pointer to linux/)
2026-03-29 16:11:50 -04:00

1.3 KiB
Raw Blame History

Express CWE-407 Scan — CLEAN

Scan date: 2026-03-29

Files scanned

  • lib/application.js — routing setup, middleware registration
  • lib/request.js — request parsing helpers
  • lib/response.js — response formatting helpers
  • lib/utils.js — ETag, MIME, trust-proxy utilities
  • lib/view.js — template view resolution
  • lib/express.js — module entry point

Findings

  • lib/request.js — String.indexOf(','), String.indexOf(':') calls are single O(N) string scans on header values, never inside loops over requests/routes.
  • lib/utils.js — type.indexOf('/') and str.indexOf(';') are single-pass content-type parser helpers; not called in nested loops.
  • lib/response.js — type.indexOf('/') once per content-type set; no loop.
  • lib/application.js — methods.forEach(...) iterates the 30 HTTP method names once at module load time to register route handlers; not called per-request.
  • res.format() — iterates the caller's key-map once; no inner membership scan.
  • Vary header handling delegates to the vary npm package (not in-tree).

Conclusion

No CWE-407 defects found in Express. All indexOf/includes calls occur in single-pass string parsing or bounded startup loops, never as inner membership checks nested inside per-request or per-route loops.