engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undf: assign UNDF-2026-000000055 to solang-0001, stamp patch

Browse source
This commit is contained in:
russell@unturf.com 2026-03-29 19:50:40 -04:00
parent a7b08c7e05
commit 0ca0eed9f9
10 changed files with 328 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

21
defects/samza/patch/CLEAN.md Normal file
View file

@ -0,0 +1,21 @@
# CLEAN — Apache Samza
Scanned 2026-03-29 for CWE-407.
## Scope
- `samza-core/src/main/java` — JobGraph, JobNode, IntermediateStreamManager, StandbyContainerManager, BlobStoreUtil, DirDiffUtil
## Findings
| Location | Pattern | Type | Result |
|----------|---------|------|--------|
| `JobGraph.findReachable` | `visited.contains` in BFS | `HashSet<JobNode>` | CLEAN |
| `JobGraph.topologicalSort` | `visited.contains` | `HashSet<JobNode>` | CLEAN |
| `JobNode.findReachableOperators` | `reachableOperators.contains` | `Set<OperatorSpec>` | CLEAN |
| `IntermediateStreamManager.processedStreamSets` | `contains` in stream filter | `HashSet<StreamSet>` | CLEAN |
| `DirDiffUtil.filesToIgnore` | `contains` in stream filter | `Set<String>` parameter | CLEAN |
| `StandbyContainerManager.standbySamzaContainerIds` | `contains` | Field type verified as `Set` | CLEAN |
All graph traversal, BFS, and deduplication patterns use `HashSet` or `Set`-typed collections throughout.
**Result: No actionable CWE-407 defects.**