engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/ruby/patch/CLEAN.md
russell@unturf.com 4d4c256673 diamond-scan: cpython/django O(2^D) hierarchy traversal; flask/rails/ruby/phoenix CLEAN 
cpython-0001: pydoc.allmethods unconditional __bases__ recursion, no visited guard
cpython-0002: turtle.__methodDict unconditional __bases__ recursion, fires at import
cpython-0003: idlelib.rpc._getmethods unconditional __bases__ recursion, IDLE debug path
django-0006: migrations.state.flatten_bases abstract model diamond traversal (comment in source acknowledges duplicates)
flask/rails/ruby/phoenix: CLEAN
2026-03-29 20:16:12 -04:00

644 B
Raw Blame History

Ruby — CWE-407 Diamond Traversal Scan: CLEAN

Scanned: 2026-03-30

Files examined

  • lib/rubygems/specification.rb — traverse method uses a Hash (visited = {}) with visited.key? guard; O(N) not O(2^D)
  • lib/bundler/vendor/thor/lib/thor/runner.rb — klasses.select { |k| k.ancestors.include?(Thor::Group) } uses Ruby's built-in linearized MRO

Result

No diamond recursion defects found. Ruby's ancestors method returns the C3-linearized MRO (no duplicates). Gem::Specification#traverse uses a Hash-based visited guard preventing re-traversal. No manually-recursive __bases__-equivalent traversal found in stdlib.