ONOS (Open Network Operating System) — CWE-407 Analysis
=========================================================

.. contents:: :local:

Overview
--------

ONOS is a Java-based software-defined networking (SDN) operating system used by carriers and
research networks. It manages network topology, flow programming, and path computation for
OpenFlow and P4-capable switches.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

No candidates found. No CWE-407 defects identified.

Triage Notes
------------

The scan targeted ``core/api``, ``core/net``, and ``apps/routing`` — the topology engine,
intent compiler, and routing application. No ``ArrayList.contains`` or ``List.indexOf`` calls
appeared near graph traversal keywords in any scanned directory.

ONOS's ``onlab.graph`` package (Dijkstra, DFS, BFS, Tarjan SCC) uses ``HashSet``-backed
visited sets throughout, consistent with modern Java practice. The SDN controller space is
clean on this metric.

The Java CWE-407 pattern is concentrated in **compilers and build tools** written in the
pre-generics era (javac, Kotlin compiler, Scala 3, Maven), not in application-layer
infrastructure written after Java 5.

References
----------

* Scan result: ``tools/scan-results/onos.txt``
