java-topology/defects/fish/patch/fish-CLEAN.md

UNDF: UNDF-2026-000000394

fish — CLEAN

Scan Date

2026-03-27

Files Scanned

• src/complete.rs (completion dedup, wrap targets)
• src/exec.rs (process execution)

Findings

No CWE-407 defects found. Fish shell has been rewritten in Rust and uses appropriate data structures throughout.

Completion dedup (unique_completions_retaining_order)

Uses HashSet::insert() for O(1) per-element dedup — correct.

Completion tombstones (COMPLETION_TOMBSTONES)

BTreeSet<WString> — O(log N) lookup — not O(N). Correct.

Wrap targets (complete_add_wrapper)

Vec::contains() on per-command wrapper list. The list is bounded by the number of wraps registered for a single command (typically 1-5). Not a cross-product loop. Correct.

Verdict

CLEAN — no algorithmic complexity defects in scanned code paths.