wave11: 488/227 — ROS2/OpenCV/Open3D/metaflow/kubeflow/optuna/openssl/mbedtls/wolfssl + Kafka Streams/Pulsar

defects/mlflow/patch/mlflow-SCAN-clean.md

@@ -0,0 +1,39 @@
+# MLflow CWE-407 Scan — CLEAN
+
+**Scan date:** 2026-03-27
+**Verdict:** No CWE-407 defects found
+**Severity:** N/A
+
+## Scope
+
+| Path | What was checked |
+|------|-----------------|
+| `mlflow/tracking/` | Experiment/run tracking, fluent API |
+| `mlflow/store/tracking/file_store.py` | File-based tracking store, run search |
+| `mlflow/store/tracking/sqlalchemy_store.py` | SQL tracking store, log_batch, tag ops |
+| `mlflow/store/model_registry/` | Model registry stores |
+| `mlflow/utils/search_utils.py` | SearchUtils.filter for runs/experiments |
+| `mlflow/projects/_project_spec.py` | Project step dependency resolution |
+
+## Analysis
+
+**SearchUtils.filter** (`search_utils.py:763–772`): Uses `run.data.tags.get(key)` and
+`run.data.params.get(key)` — both are dict lookups, O(1). No list membership in inner loops.
+
+**`_log_params`** (`sqlalchemy_store.py:1631`): Uses `existing_params = {p.key: p.value for p in run.params}`
+(dict) before the loop — O(1) key check per param. The error-path at line 1616 does a linear
+scan but only executes on IntegrityError (rare, not on the hot path).
+
+**`record_logged_model`** (`sqlalchemy_store.py:1961`): `[t for t in run.tags if t.key == MLFLOW_LOGGED_MODELS]`
+is O(T) over tags for a single call — not inside a loop, no quadratic composition.
+
+**`_set_tags`** (`sqlalchemy_store.py:1762`): Uses `.in_([t.key for t in tags])` — SQL-level bulk
+operation, not Python list membership in a loop.
+
+**Projects** (`_project_spec.py`): Step dependency resolution uses dict-based parameter lookups,
+no list membership inside loops.
+
+## Conclusion
+
+MLflow's hot paths use dicts, SQL set operations, and SQLAlchemy queries for all bulk lookups.
+No CWE-407 (O(N) linear membership inside a loop) defects found.