hive-0003

defects/zookeeper/patch/CLEAN.md

@@ -0,0 +1,30 @@
+# ZooKeeper CWE-407 Scan Result: CLEAN (beyond zookeeper-0001)
+
+## Scan Date
+2026-03-30
+
+## Scope
+`zookeeper-server/src/main/java/org/apache/zookeeper/`
+
+## Findings
+
+No new CWE-407 defects found beyond the pre-existing zookeeper-0001.
+
+### Key structures verified
+
+| Structure | Location | Type | Status |
+|-----------|----------|------|--------|
+| `forwardingFollowers` | `Leader.java:196` | `HashSet<LearnerHandler>` | CLEAN |
+| `cnxns` | `ServerCnxnFactory.java:208` | `ConcurrentHashMap`-backed Set | CLEAN |
+| `retainedTxnLogs` | `PurgeTxnLog.java:112` | `HashSet<File>` | CLEAN |
+| `aclKeyMap` | `ReferenceCountedACLCache.java` | `HashMap<List<ACL>, Long>` | CLEAN |
+| `connectingFollowers` | `Leader.java` | passed to `containsQuorum()` via Set | CLEAN |
+| `enforceAuthSchemes` | `AuthenticationHelper.java:45` | `ArrayList<String>` — but N≤5 config list, not hot | LOW (N too small) |
+| Watch managers | `WatchManager*.java` | `HashSet` / `BitSet` | CLEAN |
+
+### Note on `enforceAuthSchemes`
+
+`enforceAuthSchemes` at `AuthenticationHelper.java:45` is an `ArrayList<String>` with `.contains()`
+called in `isCnxnAuthenticated()`. However, this list contains at most 2–3 scheme strings
+configured at startup. The O(N) cost per auth check is negligible (N is bounded and tiny). This
+does not rise to the level of a CWE-407 defect.