engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undf: assign UNDF-2026-000000055 to solang-0001, stamp patch

Browse source
This commit is contained in:
russell@unturf.com 2026-03-29 19:50:40 -04:00
parent a7b08c7e05
commit 0ca0eed9f9
10 changed files with 328 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

20
defects/thrift/patch/CLEAN.md Normal file
View file

@ -0,0 +1,20 @@
# CLEAN — Apache Thrift
Scanned 2026-03-29 for CWE-407.
## Scope
- `lib/java/src/main/java` — Java runtime library (PartialThriftComparer, TBase implementations)
- `compiler/cpp/src/thrift/parse/` — C++ IDL compiler (t_scope.h, t_program.h, t_const_value.h)
## Findings
| Location | Pattern | Type | Result |
|----------|---------|------|--------|
| `PartialThriftComparer.areEqual` (Set path) | `s2.contains(e1)` in loop over s1 | `s2` is `Set<Object>` (Java Set semantics per Thrift spec) | CLEAN |
| `t_scope.h` | `types_.find`, `services_.find`, `constants_.find` | `std::map` — O(log N) | CLEAN |
| `t_program.h` | namespace lookups | `std::map` | CLEAN |
| `contrib/thrift-maven-plugin` | `thriftPathElements.contains` | Called once per directory during classpath building, not in hot loop | LOW |
The Java library is minimal and the C++ compiler uses `std::map` (ordered map, O(log N) find). No quadratic list-membership pattern exists in the production hot path.
**Result: No actionable CWE-407 defects.**