russell@unturf.com
0dbb699821
openai-python, httpx, pydantic, tiktoken, openai-node — no CWE-407 defects. All targets use proper dict/set/frozenset for membership tests in hot paths.
26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# openai-python: CLEAN
|
|
|
|
CWE-407 scan: 2026-03-30
|
|
|
|
Source: https://github.com/openai/openai-python (depth=1)
|
|
|
|
## Scan scope
|
|
|
|
- `src/openai/` — 1073 Python files
|
|
- Focus: API client model list membership, retry logic dedup, streaming chunk dedup, tool call assembly membership, batch request dedup, file upload dedup
|
|
- Keywords: `in list`, `.index(`, `if x in`, nested for loops
|
|
|
|
## Findings
|
|
|
|
No CWE-407 defects found.
|
|
|
|
- Streaming delta accumulator (`lib/streaming/_deltas.py`) uses dict-based `acc` — O(1) lookup
|
|
- Tool call done tracking (`lib/streaming/chat/_completions.py:593`) uses `set[int]` — correct
|
|
- `get_input_tool_by_name` is O(T) linear scan per call but not nested in a loop; bounded by tool count (typically < 10)
|
|
- `_base_client.py:451` creates `lower_custom_headers` list but only does 2 constant `in` checks — not O(N^2)
|
|
- `_validators.py` has O(A^2) in `additional_column_validator` but A is bounded by DataFrame columns (typically < 10)
|
|
- All dedup and membership patterns use dict/set/frozenset throughout
|
|
|
|
## Verdict
|
|
|
|
CLEAN — well-engineered SDK with proper data structure choices throughout.
|