java-topology/defects/osrm/patch/osrm-CLEAN.md

UNDF: UNDF-2026-000000495

OSRM — CWE-407 Scan Result: CLEAN

Scan Date

2026-03-27

Files Scanned

• src/engine/routing_algorithms/alternative_path_ch.cpp
• src/engine/routing_algorithms/alternative_path_mld.cpp
• src/engine/routing_algorithms/routing_base_ch.cpp
• src/engine/routing_algorithms/routing_base_mld.cpp
• src/engine/routing_algorithms/shortest_path.cpp
• src/contractor/ (full directory)
• src/extractor/ (full directory)

Findings

No CWE-407 defects found in routing hot paths.

OSRM explicitly uses appropriate O(1) data structures:

• alternative_path_ch.cpp line 638: std::unordered_set<NodeID> nodes_in_path — correct O(1) node membership for path sharing calculation
• alternative_path_mld.cpp line 292: std::unordered_set<CellID> cells — correct O(1) cell membership for path deduplication
• std::find uses found: all on small bounded vectors (trip waypoints, class names, via lists) — not in O(N) traversal loops

Notes

OSRM's CH alternative path solver (alternative_path_ch.cpp) demonstrates the correct pattern that GraphHopper's AlternativeRouteCH.java should follow: the shortest path node set is built as std::unordered_set<NodeID> before iterating the search space, giving O(1) membership tests during the O(E) sweep.