russell@unturf.com 65c4a2c263 bottle/gorm/axum/actix-web/gin/fiber: CWE-407 scan; 0 new defects, 4 CLEAN

bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict
gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps
axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains
actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only
gin: no new defects beyond gin-0001 (existing)
fiber: no new defects beyond fiber-0001 (existing)

2026-03-29 21:56:05 -04:00

1.3 KiB

Raw Blame History

CWE-407 Scan — bottle (Python micro web framework)

Result: CLEAN Date: 2026-03-30 Repo: https://github.com/bottlepy/bottle (depth=1)

Scan Summary

Scanned bottle.py (single-file framework) for O(N²) list membership patterns: visited/seen list accumulation, not in list guards inside loops, and plugin/route dedup.

Findings

No CWE-407 defects found.

Key paths examined

Path	Pattern	Verdict
`Router.match()`	Static routes use `dict` (O(1)), dynamic routes use combined regex	CLEAN
`Route.all_plugins()`	Dedup via `unique = set()` + `unique.add(name)`	CLEAN
`Bottle._mount_app()`	`self._mounts.append(app)` with no inner loop membership check	CLEAN
`SimpleTemplate._include()`	`self.cache[_name]` dict lookup for template inclusion	CLEAN
`_NamespacedImporter.load_module()`	`sys.modules` dict check — O(1)	CLEAN
`Bottle.remove_hook()`	`func in self._hooks[name]` single scan to remove — not in a loop	CLEAN

Why bottle is clean

Bottle's routing layer uses Python dict for static routes (O(1) lookup). Dynamic routes are compiled into combined regexes. Plugin deduplication uses a set(). Template inclusion uses a per-template dict cache. No accumulating visited-list inside an outer loop was found.

1.3 KiB Raw Blame History