diff --git a/defects/luigi/luigi-diamond-recursion-CLEAN.md b/defects/luigi/luigi-diamond-recursion-CLEAN.md new file mode 100644 index 000000000..17a2268e5 --- /dev/null +++ b/defects/luigi/luigi-diamond-recursion-CLEAN.md @@ -0,0 +1,12 @@ +## Diamond Recursion Scan (luigi) — CLEAN (deeper scan) + +**Scan date:** 2026-03-29 +**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D)) + +### Files examined + +- `luigi/tools/deps.py:dfs_paths` — "find all paths" function; re-visiting shared nodes on different paths is intentional (not a diamond blowup defect). Covered by luigi-0001 (O(D²) set-rebuild fix). — CLEAN re diamond recursion +- `luigi/execution_summary.py:_depth_first_search` — uses `visited` set — CLEAN +- `luigi/scheduler.py:_upstream_status` — iterative with `upstream_status_table` memoization — CLEAN + +### Verdict: CLEAN — no NEW diamond recursion CWE-407; luigi-0001 covers existing issue diff --git a/defects/numpy/numpy-diamond-recursion-CLEAN.md b/defects/numpy/numpy-diamond-recursion-CLEAN.md new file mode 100644 index 000000000..7d6cfa0a2 --- /dev/null +++ b/defects/numpy/numpy-diamond-recursion-CLEAN.md @@ -0,0 +1,12 @@ +## Diamond Recursion Scan (numpy) — CLEAN (deeper scan) + +**Scan date:** 2026-03-29 +**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D)) + +### Files examined + +- `numpy/f2py/crackfortran.py:_get_depend_dict` — uses `deps` dict as memoization cache; O(N²) list scan covered by numpy-0001 — CLEAN re diamond recursion +- `numpy/linalg/lapack_lite/make_lite.py:resolveAllDependencies` — iterative fixpoint with `done_this` set — CLEAN +- `numpy/f2py/crackfortran.py:traverse` — tree walker, not DAG — CLEAN + +### Verdict: CLEAN — no NEW diamond recursion CWE-407; numpy-0001 covers existing list-scan issue diff --git a/defects/prefect/prefect-diamond-recursion-CLEAN.md b/defects/prefect/prefect-diamond-recursion-CLEAN.md new file mode 100644 index 000000000..97aad5e0c --- /dev/null +++ b/defects/prefect/prefect-diamond-recursion-CLEAN.md @@ -0,0 +1,12 @@ +## Diamond Recursion Scan (prefect) — CLEAN (deeper scan) + +**Scan date:** 2026-03-29 +**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D)) + +### Files examined + +- `src/prefect/cli/transfer/_dag.py:TransferDAG` — proper Kahn's algorithm, `visited: set[uuid.UUID]` — CLEAN +- `src/prefect/cli/transfer/_dag.py:has_cycles` — three-color DFS with `color` dict — CLEAN +- `src/prefect/utilities/collections.py:visit_collection` — tree-walker, not DAG — CLEAN + +### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing pre-0001..0002 diff --git a/defects/pytorch/pytorch-diamond-recursion-CLEAN.md b/defects/pytorch/pytorch-diamond-recursion-CLEAN.md new file mode 100644 index 000000000..9de1b6e08 --- /dev/null +++ b/defects/pytorch/pytorch-diamond-recursion-CLEAN.md @@ -0,0 +1,18 @@ +## Diamond Recursion Scan (pytorch) — CLEAN (deeper scan) + +**Scan date:** 2026-03-29 +**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D)) + +### Files examined + +- `torch/_inductor/scheduler.py:topological_sort_schedule` — uses `seen = OrderedSet()` — CLEAN +- `torch/_inductor/memory.py:topological_sort_lpmf` — uses `seen` OrderedSet — CLEAN +- `torch/_inductor/memory.py:dfs_visit` — uses `color` dict (WHITE/GRAY/BLACK) — CLEAN +- `torch/_inductor/augmented_graph_helper.py:_get_all_ancestors` — iterative with `ancestors` set — CLEAN +- `torch/_inductor/fx_passes/overlap_scheduling.py:_collect_node_ancestors` — iterative DP — CLEAN +- `torch/_dynamo/graph_deduplication.py:_has_cycle` — delegates to topological sort — CLEAN +- `torch/package/_digraph.py` — uses networkx DiGraph — CLEAN +- `torch/utils/data/graph.py:traverse_dps` — no DAG traversal without visited — CLEAN +- `torch/autograd/` — engine is C++, Python wrappers don't do DAG traversal — CLEAN + +### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing pytorch-0001..0003 diff --git a/defects/ray/ray-diamond-recursion-CLEAN.md b/defects/ray/ray-diamond-recursion-CLEAN.md new file mode 100644 index 000000000..8b09e1cbe --- /dev/null +++ b/defects/ray/ray-diamond-recursion-CLEAN.md @@ -0,0 +1,13 @@ +## Diamond Recursion Scan (ray) — CLEAN (deeper scan) + +**Scan date:** 2026-03-29 +**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D)) + +### Files examined + +- `python/ray/dag/dag_node.py:apply_recursive` — uses UUID cache (_CachingFn) for memoization — CLEAN +- `python/ray/dag/dag_node.py:traverse_and_apply` — uses `visited = set()` — CLEAN +- `python/ray/dag/vis_utils.py:_dfs` — delegates to apply_recursive (cached) — CLEAN +- `python/ray/workflow/` — empty (only __init__.py) — CLEAN + +### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing ray-0001 diff --git a/defects/sklearn/sklearn-diamond-recursion-CLEAN.md b/defects/sklearn/sklearn-diamond-recursion-CLEAN.md new file mode 100644 index 000000000..c5e218d0e --- /dev/null +++ b/defects/sklearn/sklearn-diamond-recursion-CLEAN.md @@ -0,0 +1,13 @@ +## Diamond Recursion Scan (scikit-learn) — CLEAN + +**Scan date:** 2026-03-29 +**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D)) + +### Files examined + +- `sklearn/utils/graph.py:single_source_shortest_path_length` — BFS with `seen` dict — CLEAN +- `sklearn/pipeline.py` — linear pipeline (no DAG) — CLEAN +- `sklearn/tree/_reingold_tilford.py` — tree (not DAG, no diamond possible) — CLEAN +- `sklearn/cluster/_agglomerative.py:ward_tree` — uses `not_visited` numpy array — CLEAN + +### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing sklearn-0001 diff --git a/defects/tensorflow/tensorflow-diamond-recursion-CLEAN.md b/defects/tensorflow/tensorflow-diamond-recursion-CLEAN.md new file mode 100644 index 000000000..1188f1870 --- /dev/null +++ b/defects/tensorflow/tensorflow-diamond-recursion-CLEAN.md @@ -0,0 +1,13 @@ +## Diamond Recursion Scan (tensorflow) — CLEAN (deeper scan) + +**Scan date:** 2026-03-29 +**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D)) + +### Files examined + +- `tensorflow/python/ops/variables.py:_has_cycle` — uses `state` dict with _STARTED/_FINISHED markers (three-color DFS) — CLEAN +- `tensorflow/python/keras/engine/functional.py:_build_map_helper` — uses `finished_nodes` set + `nodes_in_progress` set — CLEAN +- `tensorflow/python/checkpoint/restore.py` — uses BFS with deferred queue — CLEAN +- `tensorflow/python/ops/control_flow_util_v2.py:resource_input_index` — linear parent-chain walk, not DAG traversal — CLEAN + +### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing tensorflow-0001