java-topology/defects/lua/patch/CLEAN.md

Lua — CWE-407 Diamond Recursion Scan: CLEAN

Scan Date

2026-03-29

Targets Checked

1. Metamethod dispatch (__index / __newindex chains, lvm.c)

• File: lvm.c, line 50: #define MAXTAGLOOP 2000
• Mechanism: Tag-method chains are bounded by MAXTAGLOOP counter (2000 steps). Any __index chain exceeding this triggers luaG_runerror("'__index' chain too long").
• No recursive graph traversal — iterative loop with hard cap.
• Result: CLEAN (bounded by counter).

2. Type system

• Lua is dynamically typed. There is no compile-time type hierarchy, no module inclusion graph, and no type inference pass.
• No concept of module diamonds exists at the language level.
• Result: CLEAN (not applicable).

3. Parser (lparser.c)

• Block/scope tracking uses a linked list of BlockCnt structs — O(depth) stack. No graph traversal.
• Result: CLEAN.

Conclusion

No CWE-407 diamond recursion defects found in Lua. The language has no compile-time type graph; runtime metamethod chains are bounded by MAXTAGLOOP.