engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/rhythmbox/patch/CLEAN.md
russell@unturf.com 669ed13408 clementine: 2 CWE-407 defects; mpd + rhythmbox CLEAN 
clementine-0001: LibraryWatcher ScanSubdirectory FindSongByPath O(F*S) +
files_on_disk.contains O(S*F) — linear scan with TODO comment, fix with
HashMap + HashSet. HIGH severity, 250x at N=1000.

clementine-0002: SongSender indexOf(s) O(N^2) in SendAlbum/SendPlaylist/
SendUrls loops — fix with integer counter + QSet for requested_ids.
MEDIUM severity, 500x at N=1000.

MPD: CLEAN — uses std::set, bitmask arrays, std::map throughout.
Rhythmbox: CLEAN — uses g_hash_table for all membership checks.

4/4 unit tests PASS.
2026-03-30 14:42:15 -04:00

967 B
Raw Blame History

Rhythmbox - CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30 Source: https://github.com/GNOME/rhythmbox (depth=1)

Scan Summary

Rhythmbox uses GLib hash tables throughout for membership testing:

  • Database entries: g_hash_table for entry storage and lookup
  • Property model: g_hash_table (reverse_map) + g_sequence (balanced tree) for properties
  • Keyword tracking: g_hash_table for keyword-to-entry mapping
  • Playlist membership: g_hash_table via rb_playlist_source_location_in_map
  • Changed entries: g_hash_table for tracking changes
  • Import dedup: g_hash_table for added/deleted entry tracking

The rb_string_list_contains calls (linear GList scan) are used only for mount-point lists which are bounded to a handful of entries (typically 2-5 filesystem mount points).

The g_list_find calls in display-page-model operate on DnD target atom lists (bounded by GTK target types, ~10 max).

No CWE-407 defects found.