russell@unturf.com
896a29f83b
erpnext-0001: BOM.get_children list dedup O(B^2) MEDIUM 4x erpnext-0002: serial_batch_bundle serial/batch dedup O(N^2) HIGH 45x ofbiz-0001: PaymentGatewayServices processList LinkedList O(N^2) HIGH 45x ofbiz-0002: OrderReturnServices/OrderReadHelper payment dedup O(N^2) MEDIUM 36x odoo: CLEAN (consistent set/frozenset/OrderedSet usage throughout)
25 lines
995 B
Markdown
25 lines
995 B
Markdown
# Odoo — CWE-407 Scan Result: CLEAN
|
|
|
|
**Scanned:** 2026-03-30
|
|
**Source:** https://github.com/odoo/odoo (v19.0)
|
|
**Scanner:** manual CWE-407 audit
|
|
|
|
## Summary
|
|
|
|
No CWE-407 (algorithmic complexity via linear membership test in a loop) defects found.
|
|
|
|
## Notes
|
|
|
|
Odoo's codebase is well-protected against this class of defect:
|
|
|
|
- ORM core (`odoo/orm/`) uses `set`, `frozenset`, `OrderedSet`, and `dict` consistently
|
|
for membership tests in loops
|
|
- Recordsets implement set-based `__contains__` (O(1))
|
|
- `tools/misc.py` `unique()` helper uses `set` for dedup
|
|
- Module loading uses `dict`/`set` for loaded module tracking
|
|
- Record rules use SQL-based evaluation, not list scanning
|
|
- Field dependency tracking uses `Collector` (dict of tuples) with small per-key sizes
|
|
- Access control uses SQL queries, not list iteration
|
|
|
|
The `Collector.add()` method in `tools/misc.py` does `if val not in vals` on a tuple,
|
|
but it is only called from field setup (not a hot loop) and tuple sizes are typically 1-3.
|