27 lines
1.3 KiB
Markdown
27 lines
1.3 KiB
Markdown
# Gitea — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned: 2026-03-30
|
|
Target: https://github.com/go-gitea/gitea (Go)
|
|
Focus: models/, services/, routers/, modules/ — permissions, issues, reviews, actions, git operations
|
|
|
|
## Summary
|
|
|
|
No CWE-407 defects found. Gitea has a dedicated `container.Set[T]` (modules/container/set.go)
|
|
that wraps `map[T]struct{}` for O(1) membership tests. Hot paths use this correctly.
|
|
|
|
91 `slices.Contains` calls found across 59 files, but all operate on:
|
|
|
|
- Constant-size unit type arrays (< 10 elements)
|
|
- Config-level whitelist/blacklist IDs (branch protection, actions config)
|
|
- Small fixed enum slices (action types, user types, comment types)
|
|
- Single-call patterns not inside loops
|
|
|
|
## Notable non-defects reviewed
|
|
|
|
- `models/actions/runner.go` CanMatchLabels — uses container.SetOf() (hash set) correctly
|
|
- `models/git/protected_branch.go` updateTeamWhitelist — settings-update path, small lists
|
|
- `models/actions/task.go` CreateTaskForRunner — uses CanMatchLabels with hash set
|
|
- `models/issues/issue.go` IsParticipant — single slices.Contains, not in a loop
|
|
- `models/issues/review_list.go` — uses map[int64]*User for O(1) lookup
|
|
- `modules/dump/dumper.go` shouldExclude — CLI dump path, excludes list < 10
|
|
- `services/actions/notifier_helper.go` — DisabledWorkflows typically < 10
|