MySQL / MariaDB — CWE-407 Analysis
====================================

.. contents:: :local:

Overview
--------

MySQL and its fork MariaDB are widely deployed relational databases. The query optimizer
performs join graph analysis, subquery transformation, and dependency graph construction for
prepared statements and views.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

Scan returned 10 candidates from ``sql/`` and ``storage/innobase/``. All triaged as false
positives or INFORMATIONAL (bounded, non-hot-path).

Triage Notes
------------

+-----------------------------------------------+-----------------------------------+----------+
| Candidate                                     | Container type                    | Verdict  |
+===============================================+===================================+==========+
| ``trivial_receiver.h:38`` HasSeen()           | ``mem_root_unordered_set<NodeMap>``| CLEAN    |
+-----------------------------------------------+-----------------------------------+----------+
| ``window.cc:1004`` ``completed.count(i)``     | ``std::unordered_set<uint>``      | CLEAN    |
+-----------------------------------------------+-----------------------------------+----------+
| ``hypergraph.cc:32,34,58`` RemoveElement      | ``std::vector<T>`` std::find      | INFO     |
+-----------------------------------------------+-----------------------------------+----------+
| ``sql_resolver.cc:9096,9103`` find            | ``fields`` list — one-off lookup  | FP       |
+-----------------------------------------------+-----------------------------------+----------+
| ``changestreams/applier_metrics.cc:42``       | micros counter increment          | FP       |
+-----------------------------------------------+-----------------------------------+----------+

**INFORMATIONAL** — ``hypergraph.cc`` ``RemoveElement``: uses ``std::find`` on a
``std::vector`` to find and remove an edge from a node's adjacency list during
``ModifyEdge``. This is O(degree) per call, and ``ModifyEdge`` is called O(edges) times
during query graph simplification. In the worst case this is O(E×degree) = O(E²/V), but:

- The hypergraph optimizer is only invoked when ``optimizer_switch=hypergraph_optimizer=on``
  (default off in current releases)
- The degree of any node in a join hypergraph is bounded by the number of join predicates
  involving that table, which is small in practice

Not a production defect. Recorded as INFORMATIONAL.

The TrivialReceiver used for DPhyp subgraph enumeration uses ``mem_root_unordered_set`` — O(1).
Window function dependency graph uses ``std::unordered_set`` — O(1). Both are correct.

Key Finding
-----------

MySQL's hypergraph join optimizer uses ``unordered_set`` for all hot-path visited-state
tracking. The ``RemoveElement`` vector find is in graph *mutation* (edge removal), not graph
*traversal* (membership test on visited set). No CWE-407 defect.

References
----------

* Scan result: ``tools/scan-results/mysql.txt``
