engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/openai-python/CLEAN.md
russell@unturf.com 0dbb699821 openai SDK dependency chain CWE-407 scan: all 5 targets CLEAN 
openai-python, httpx, pydantic, tiktoken, openai-node — no CWE-407 defects.
All targets use proper dict/set/frozenset for membership tests in hot paths.
2026-03-30 16:44:33 -04:00

1.1 KiB
Raw Blame History

openai-python: CLEAN

CWE-407 scan: 2026-03-30

Source: https://github.com/openai/openai-python (depth=1)

Scan scope

  • src/openai/ — 1073 Python files
  • Focus: API client model list membership, retry logic dedup, streaming chunk dedup, tool call assembly membership, batch request dedup, file upload dedup
  • Keywords: in list, .index(, if x in, nested for loops

Findings

No CWE-407 defects found.

  • Streaming delta accumulator (lib/streaming/_deltas.py) uses dict-based acc — O(1) lookup
  • Tool call done tracking (lib/streaming/chat/_completions.py:593) uses set[int] — correct
  • get_input_tool_by_name is O(T) linear scan per call but not nested in a loop; bounded by tool count (typically < 10)
  • _base_client.py:451 creates lower_custom_headers list but only does 2 constant in checks — not O(N^2)
  • _validators.py has O(A^2) in additional_column_validator but A is bounded by DataFrame columns (typically < 10)
  • All dedup and membership patterns use dict/set/frozenset throughout

Verdict

CLEAN — well-engineered SDK with proper data structure choices throughout.