1.4 KiB
1.4 KiB
UNDF: UNDF-2026-000000352
axum — CWE-407 Scan Result: CLEAN
Date: 2026-03-27
Source: https://github.com/tokio-rs/axum (depth=1)
Scanned: axum/src/, axum-core/src/ (excluding test modules)
Summary
No CWE-407 defects found in axum's production code paths.
Candidates Evaluated
| Location | Pattern | Verdict |
|---|---|---|
routing/method_routing.rs:885 |
endpoint_filter.contains(filter) |
DISQUALIFIED — MethodFilter is a bitflag struct; .contains() is bitwise AND, not a linear scan. |
routing/method_routing.rs:1233 |
s.contains(method) in append_allow_header |
DISQUALIFIED — s is a comma-separated Allow header string over at most ~9 HTTP methods (bounded constant). |
routing/path_router.rs:100 |
for endpoint in self.routes.iter_mut() |
DISQUALIFIED — iterates all routes once with no inner membership test; applies a transformation. |
extract/ws.rs:257 |
self.sec_websocket_protocol.contains(&proto) |
DISQUALIFIED — sec_websocket_protocol is a BTreeSet<HeaderValue>, not a Vec; O(log N) lookup. |
response/sse.rs:315,335,382,450 |
self.flags.contains(...) |
DISQUALIFIED — bitflag operations on EventFlags. |
Conclusion
Axum's router uses matchit (radix trie) for path dispatch, BTreeSet for WebSocket protocol tracking, and bitflags for method filters. No unbounded linear membership tests found.