engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/qbittorrent/patch/CLEAN.md
russell@unturf.com 0b5409ff95 libtorrent-0001/qbittorrent: CWE-407 scan — 1 defect, 1 CLEAN 
libtorrent-0001: file_storage::get_or_add_path std::find on m_paths vector O(F*P) MEDIUM 250x
qBittorrent: CLEAN (QSet/QHash throughout for membership tests)
2026-03-30 10:39:32 -04:00

1.1 KiB
Raw Blame History

qBittorrent — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30 Target: qBittorrent (C++/Qt) Source: https://github.com/qbittorrent/qBittorrent

Scope

  • src/base/bittorrent/ — session, torrent impl, tracker, peer management
  • src/base/rss/ — RSS auto-downloader, parser, feed management
  • src/base/search/ — search plugin manager
  • src/gui/ — transfer list, tracker list, tag/category filtering
  • src/webui/ — API controllers, sync controller

Finding

CLEAN. qBittorrent uses appropriate data structures throughout:

  • Tags: OrderedSet<Tag> (std::set) — O(log N) membership
  • Categories: QHash<QString, CategoryOptions> — O(1) membership
  • Torrents: QHash<TorrentID, TorrentImpl*> — O(1) lookup
  • Banned IPs: sorted QStringList but only accessed from user actions, not hot paths
  • Trackers: QHash/QSet for tracker host dedup in filter widgets
  • RSS article IDs: QSet<QString> — O(1) dedup
  • Search disabled plugins: QStringList with O(N) contains, but N < 50 always

No QList/QVector linear membership test found in any hot loop or per-packet/per-torrent-update path.