OpenDaylight — CWE-407 Analysis
=================================

.. contents:: :local:

Overview
--------

OpenDaylight (ODL) is a Java-based SDN controller platform maintained by the Linux Foundation.
It provides northbound APIs for network applications and southbound plugins for network devices,
including graph topology management and BGP/PCEP path computation.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

No candidates found in ``mdsal`` or ``bgpcep``. No CWE-407 defects identified.

Triage Notes
------------

Two repositories were scanned: ``mdsal`` (Model-Driven Service Abstraction Layer — ODL's
core data-binding and topology framework) and ``bgpcep`` (BGP/PCEP/BMP plugin).

Neither repository showed ``ArrayList.contains`` or ``List.indexOf`` near graph traversal
keywords. Both use modern Java collections — ``HashSet``, ``LinkedHashSet``, ``HashMap`` —
for visited-state tracking throughout their graph and topology algorithms.

Consistent with the ONOS finding: application-layer Java SDN infrastructure written after
Java 5 uses idiomatic hash collections. The defect pattern targets compiler and build tool
codebases written in the pre-generics era.

References
----------

* Scan result: ``tools/scan-results/opendaylight.txt``
