russell@unturf.com 52a8d535a2 dubbo-0001 + cxf-0001: annotation diamond recursion O(2^D); WSDL import O(N²); count 621→623

dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph
without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238)

cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains
as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237)

Struts, RabbitMQ, Camel: CLEAN

2026-03-29 18:23:19 -04:00

1.3 KiB

Raw Blame History

Apache Struts — CWE-407 Scan Result: CLEAN

Scan Date: 2026-03-29

Method Scanned

Searched core/ for recursive traversal of interceptor/action dependency graphs without visited sets.

Findings

ActionChainResult — action chain cycle detection

ActionChainResult uses a LinkedList<String> chain history stored in ActionContext as the cycle guard. The chain is appended on each hop; an IllegalArgumentException is thrown if the action name is already in the chain (infinite recursion guard). This is O(N) list membership per hop for N chain steps — acceptable for short action chains (typically 1-3 deep in practice, bounded by configuration). Not a hot path in production traffic.

InterceptorBuilder.constructParameterizedInterceptorReferences

The recursive call here resolves nested interceptor-stack parameter names. Recursion is driven by dotted-param keys (stack1.interceptor1.param) that are consumed at each level — no shared DAG is traversed. Termination is guaranteed by the param key prefix being stripped on each level. No visited guard needed; not CWE-407.

InterceptorStackConfig.getInterceptors

Returns a pre-built flat List<InterceptorMapping> — no recursive graph traversal at runtime.

Conclusion

CLEAN. No CWE-407 defects found in Apache Struts.

1.3 KiB Raw Blame History