java-topology/defects/gitea/patch/CLEAN.md

Gitea — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30 Target: https://github.com/go-gitea/gitea (Go) Focus: models/, services/, routers/, modules/ — permissions, issues, reviews, actions, git operations

Summary

No CWE-407 defects found. Gitea has a dedicated container.Set[T] (modules/container/set.go) that wraps map[T]struct{} for O(1) membership tests. Hot paths use this correctly.

91 slices.Contains calls found across 59 files, but all operate on:

• Constant-size unit type arrays (< 10 elements)
• Config-level whitelist/blacklist IDs (branch protection, actions config)
• Small fixed enum slices (action types, user types, comment types)
• Single-call patterns not inside loops

Notable non-defects reviewed

• models/actions/runner.go CanMatchLabels — uses container.SetOf() (hash set) correctly
• models/git/protected_branch.go updateTeamWhitelist — settings-update path, small lists
• models/actions/task.go CreateTaskForRunner — uses CanMatchLabels with hash set
• models/issues/issue.go IsParticipant — single slices.Contains, not in a loop
• models/issues/review_list.go — uses map[int64]*User for O(1) lookup
• modules/dump/dumper.go shouldExclude — CLI dump path, excludes list < 10
• services/actions/notifier_helper.go — DisabledWorkflows typically < 10