russell@unturf.com
bbf4510d9d
musescore-0001: CWE-407 pastedHarmony dedup uses std::vector+std::find O(A*H) in Read400/Read410/Read460::pasteStaff; fix: unordered_set O(A). 100.5x op-count speedup at H=200 harmonies pasted. 1/1 PASS. musescore-0002: CWE-312 OAuth access+refresh tokens logged verbatim via LOGD() in AbstractCloudService::onUserAuthorized(); fix: redact values. 1/1 PASS. mixxx: all 5 MOADs CLEAN. Only std::find on a 6-item capped list; all cache lookups use QHash/QSet O(1); GlobalTrackCache properly mutex-locked; no thread_local misuse; no credential values in log calls.
1.5 KiB
Mixxx — 5-MOAD Scan — CLEAN
Target: mixxxdj/mixxx (depth=1, 2026-03-31) Focus: src/library/, src/track/, src/effects/, src/engine/
MOAD-0001 (CWE-407): CLEAN
Only 1 std::find hit in production code:
src/library/trackset/setlogfeature.cpp:600— searchesm_recentTracks(astd::listcapped at 6 items by design). O(6) is constant; not a defect.
All QHash/QSet/QMap .contains() calls are O(1). No vector/list linear scans inside loops.
effectpreset.cpp already has an explicit comment noting the O(n^2) risk and using a QHash
to avoid it.
MOAD-0002 (Intertangle): CLEAN
CoverArtCache is a singleton but interacts with the rest of the system through signals and
explicit pointer injection, not shared mutable god-object state. GlobalTrackCache and
TrackCollectionManager follow similar clean interface patterns.
MOAD-0003 (Leaked Context): CLEAN
No thread_local usage in production source. Thread identity is passed explicitly via
QThread::setObjectName for naming only, not for routing request-scoped context.
MOAD-0004 (CWE-312): CLEAN
No credential values logged. broadcastprofile.cpp logs warning strings about invalid
password format but never logs the password value itself. No OAuth tokens found in log calls.
MOAD-0005 (Thundering Herd): CLEAN
GlobalTrackCache uses QMutex (m_mutex.lock()/unlock()) via GlobalTrackCacheLocker
RAII guard for all cache reads and writes. No unsynchronized cache-get+null+compute+put pattern.