infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN

consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet

6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza

defects/buildkit/patch/CLEAN.md

@@ -1,17 +1,14 @@
 # buildkit — CWE-407 Scan Result: CLEAN
 
-Scanned: 2026-03-29
+Scanned 2026-03-29.
 
-## Scope
+## Findings
 
-- `cache/refs.go` — `walkBlobVariantsOnly`: uses `map[digest.Digest]struct{}` visited set.
-- `cache/remotecache/v1/cachestorage.go` — `addItemToStorage`: uses
-  `map[*item]*itemWithOutgoingLinks` visited guard.
-- `cache/remotecache/v1/parse.go` — `getRemoteChain`: uses `map[int]struct{}` visited set.
-- `cache/remote.go` — `slices.ContainsFunc` / `slices.Contains`: used on small bounded
-  descriptor/repo slices, not in hot nested loops over the full layer graph.
+No custom slice-contains helpers. `slices.Contains` and `slices.ContainsFunc` used
+in bounded contexts (compression type checks, platform filtering, annotation
+repository dedup per descriptor — the `existingRepos` list is rebuilt from
+comma-separated annotations per descriptor, not accumulated across descriptors).
 
-## Verdict
+Graph traversal in `remotecache/v1/parse.go` uses a `map[int]struct{}` visited set.
 
-No CWE-407 defects found. buildkit's build graph and layer cache traversal use proper
-hash-map visited structures.
+**Verdict: CLEAN** — no CWE-407 defects warranting a patch.

defects/consul/patch/consul-0001-mesh-gateway-peername-hashset.md

@@ -0,0 +1,94 @@
+# UNDF: UNDF-2026-000000090
+# UNDF: (pending)
+# consul-0001: makeMeshGatewayPeerFilterChain — peerNames O(S×B×P) slice lookup
+
+## CWE-407 — Algorithmic Complexity
+
+| Field | Value |
+|-------|-------|
+| ID | consul-0001 |
+| Severity | MEDIUM |
+| Ecosystem | consul |
+| Package | agent/xds |
+| File | `agent/xds/listeners.go` |
+| Lines | 2282–2286 |
+| Complexity | O(S×B×P) — services × bundles × peers per service |
+| Hot path | Mesh gateway listener rebuild on every topology change |
+
+## Defect
+
+`makeMeshGatewayPeerFilterChain` receives `peerNames []string` (the set of peer names
+for this exported service) and iterates over all peering trust bundles, calling
+`stringslice.Contains(peerNames, bundle.PeerName)` for each bundle:
+
+```go
+// agent/xds/listeners.go
+for _, bundle := range cfgSnap.MeshGateway.PeeringTrustBundles {   // O(B)
+    if stringslice.Contains(peerNames, bundle.PeerName) {           // O(P) scan
+        peerBundles = append(peerBundles, bundle)
+    }
+}
+```
+
+`stringslice.Contains` is a linear scan:
+
+```go
+// lib/stringslice/stringslice.go
+func Contains(l []string, s string) bool {
+    for _, v := range l {
+        if v == s {
+            return true
+        }
+    }
+    return false
+}
+```
+
+The outer caller iterates over all exported services:
+
+```go
+for _, svc := range cfgSnap.MeshGatewayValidExportedServices() {   // O(S)
+    peerNames := cfgSnap.MeshGateway.ExportedServicesWithPeers[svc]
+    filterChain, err := s.makeMeshGatewayPeerFilterChain(cfgSnap, svc, peerNames, chain)
+```
+
+Total: O(S × B × P). In a production Consul cluster with S=50 services, B=20 trust
+bundles, P=20 peers per service, each listener rebuild costs 50×20×20 = 20,000
+string comparisons instead of 50×20 = 1,000 map lookups.
+
+## Fix
+
+Convert `peerNames` to a `map[string]bool` before the bundle loop:
+
+```go
+// Before:
+var peerBundles []*pbpeering.PeeringTrustBundle
+for _, bundle := range cfgSnap.MeshGateway.PeeringTrustBundles {
+    if stringslice.Contains(peerNames, bundle.PeerName) {
+        peerBundles = append(peerBundles, bundle)
+    }
+}
+
+// After:
+peerNameSet := make(map[string]struct{}, len(peerNames))
+for _, p := range peerNames {
+    peerNameSet[p] = struct{}{}
+}
+var peerBundles []*pbpeering.PeeringTrustBundle
+for _, bundle := range cfgSnap.MeshGateway.PeeringTrustBundles {
+    if _, ok := peerNameSet[bundle.PeerName]; ok {
+        peerBundles = append(peerBundles, bundle)
+    }
+}
+```
+
+Alternatively, `ExportedServicesWithPeers` could store `map[string]struct{}` instead of
+`[]string`, propagating O(1) lookup to all callers.
+
+## Speedup
+
+| S (services) | B (bundles) | P (peers) | Before (ops) | After (ops) | Speedup |
+|---|---|---|---|---|---|
+| 10 | 10 | 10 | 1,000 | 200 | 5× |
+| 50 | 20 | 20 | 20,000 | 2,000 | 10× |
+| 100 | 50 | 50 | 250,000 | 10,000 | 25× |

defects/containerd/patch/CLEAN.md

@@ -1,17 +1,16 @@
 # containerd — CWE-407 Scan Result: CLEAN
 
-Scanned: 2026-03-29
+Scanned 2026-03-29.
 
-## Scope
+## Findings
 
-- `cache/refs.go` — `walkUniqueAncestors`/`walkBlobVariantsOnly`: uses
-  `map[digest.Digest]struct{}` visited set for layer graph traversal. Correct O(V+E).
-- `cache/remotecache/v1/` — `addItemToStorage`, `getRemoteChain`: both use
-  `map[*item]*itemWithOutgoingLinks` / `map[int]struct{}` visited guards. Correct.
-- All `slices.Contains` call sites: used on small bounded option/capability slices
-  (mount options, platform lists), never inside a per-item outer loop.
+`slices.Contains` is used in several paths (mount options, capabilities, snapshotter
+capabilities, platform lists) but all target lists are small and bounded (typically
+< 10 elements): mount option flags, GID lists, network namespace types.
 
-## Verdict
+No O(N²) patterns in hot paths (content ingestion, snapshot chain management,
+layer unpacking). The `cacheResultStorage.HasLink()` in `remotecache/v1/cachestorage.go`
+calls `slices.Contains(it.links[l], target)` but `it.links[l]` is a deduplicated
+list of cache targets per link key — bounded in practice.
 
-No CWE-407 defects found. containerd's layer deduplication and cache traversal use
-proper hash-map visited guards.
+**Verdict: CLEAN** — no CWE-407 defects warranting a patch.

defects/doris/patch/doris-0001-equivalence-class-list-contains-hashset.md

@@ -0,0 +1,78 @@
+# UNDF: UNDF-2026-000000381
+# UNDF: (pending)
+# doris-0001: EquivalenceClass.getEquivalenceSetList — O(N²) List.contains dedup
+
+## CWE-407 — Algorithmic Complexity
+
+| Field | Value |
+|-------|-------|
+| ID | doris-0001 |
+| Severity | MEDIUM |
+| Ecosystem | doris |
+| Package | fe-core |
+| File | `fe/fe-core/src/main/java/org/apache/doris/nereids/rules/exploration/mv/EquivalenceClass.java` |
+| Lines | 130–146 |
+| Complexity | O(N²) |
+| Hot path | Called during materialized view rewrite in query planning (every query with MV candidates) |
+
+## Defect
+
+`getEquivalenceSetList()` deduplicates equivalence class lists using a `List<List<SlotReference>>`
+as the visited set. `visited.contains(slotSet)` calls `ArrayList.contains()` which iterates the
+entire visited list comparing lists element-by-element — O(N) per call. The outer loop also
+iterates N times, making the total complexity O(N²) where N is the number of distinct equivalence
+slot lists in `equivalenceSlotMap.values()`.
+
+This runs on every query that touches materialized view rewrite logic in Doris Nereids.
+
+```java
+public List<List<SlotReference>> getEquivalenceSetList() {
+    if (equivalenceSlotList != null) {
+        return equivalenceSlotList;
+    }
+    List<List<SlotReference>> equivalenceSets = new ArrayList<>();
+    List<List<SlotReference>> visited = new ArrayList<>();         // O(N) per contains
+    equivalenceSlotMap.values().forEach(slotSet -> {
+        if (!visited.contains(slotSet)) {                          // O(N) scan
+            equivalenceSets.add(slotSet);
+        }
+        visited.add(slotSet);
+    });
+    this.equivalenceSlotList = equivalenceSets;
+    return this.equivalenceSlotList;
+}
+```
+
+## Fix
+
+`equivalenceSlotMap` maps each `SlotReference` to its equivalence-class list (which is a shared
+`List<SlotReference>` object). Deduplication by object identity is sufficient and correct because
+the union-find structure ensures all members of an equivalence class share the same list reference.
+Use `IdentityHashMap` or `Set` based on object identity:
+
+```java
+public List<List<SlotReference>> getEquivalenceSetList() {
+    if (equivalenceSlotList != null) {
+        return equivalenceSlotList;
+    }
+    // Use identity comparison: all slots in the same equivalence class share the same List object
+    Set<List<SlotReference>> seen = Collections.newSetFromMap(new IdentityHashMap<>());
+    List<List<SlotReference>> equivalenceSets = new ArrayList<>();
+    for (List<SlotReference> slotSet : equivalenceSlotMap.values()) {
+        if (seen.add(slotSet)) {                                    // O(1) identity hash
+            equivalenceSets.add(slotSet);
+        }
+    }
+    this.equivalenceSlotList = equivalenceSets;
+    return this.equivalenceSlotList;
+}
+```
+
+## Speedup
+
+| N (equivalence classes) | Before (ops) | After (ops) | Speedup |
+|-------------------------|-------------|-------------|---------|
+| 10 | 100 | 10 | 10× |
+| 50 | 2,500 | 50 | 50× |
+| 100 | 10,000 | 100 | 100× |
+| 500 | 250,000 | 500 | 500× |

defects/doris/patch/doris-0002-plannode-conjuncts-linkedhashset.md

@@ -0,0 +1,101 @@
+# UNDF: (pending)
+# doris-0002: PlanNode.addConjunct — ArrayList.contains() O(C²) dedup
+
+## CWE-407 — Algorithmic Complexity
+
+| Field | Value |
+|-------|-------|
+| ID | doris-0002 |
+| Severity | MEDIUM |
+| Ecosystem | doris |
+| Package | fe-core/planner |
+| File | `fe/fe-core/src/main/java/org/apache/doris/planner/PlanNode.java` |
+| Lines | 308–324 |
+| Complexity | O(C²) — C conjuncts, each `addConjuncts()` call scans the list |
+| Hot path | Query planning — `addConjunctsToPlanNode` in PhysicalPlanTranslator |
+
+## Defect
+
+`PlanNode.conjuncts` is an `ArrayList<Expr>`. The `addConjunct` method deduplicates
+by calling `ArrayList.contains()`, which is O(C):
+
+```java
+// PlanNode.java
+protected List<Expr> conjuncts = Lists.newArrayList();
+
+public void addConjuncts(List<Expr> conjuncts) {
+    if (conjuncts == null) return;
+    for (Expr conjunct : conjuncts) {    // O(C_new)
+        addConjunct(conjunct);
+    }
+}
+
+public void addConjunct(Expr conjunct) {
+    if (conjuncts == null) {
+        conjuncts = Lists.newArrayList();
+    }
+    if (!conjuncts.contains(conjunct)) {  // O(C_existing) scan
+        conjuncts.add(conjunct);
+    }
+}
+```
+
+`PhysicalPlanTranslator.addConjunctsToPlanNode` calls this from a double loop:
+
+```java
+// PhysicalPlanTranslator.java:3039-3047
+private void addConjunctsToPlanNode(PhysicalFilter<? extends Plan> filter,
+        PlanNode planNode, PlanTranslatorContext context) {
+    for (Expression conjunct : filter.getConjuncts()) {                     // O(F)
+        for (Expression singleConjunct : ExpressionUtils.extractConjunctionToSet(conjunct)) { // O(K)
+            planNode.addConjunct(ExpressionTranslator.translate(singleConjunct, context)); // O(C)
+        }
+    }
+}
+```
+
+Total: O(F × K × C) — with F=filter conjuncts, K=sub-conjuncts per predicate,
+C=existing conjuncts in node. At C=100 conjuncts, each `addConjunct` call costs
+100 equality comparisons instead of O(1).
+
+## Fix
+
+Replace `conjuncts` with a `LinkedHashSet<Expr>` (preserves insertion order,
+O(1) contains):
+
+```java
+// Before:
+protected List<Expr> conjuncts = Lists.newArrayList();
+
+public void addConjunct(Expr conjunct) {
+    if (conjuncts == null) {
+        conjuncts = Lists.newArrayList();
+    }
+    if (!conjuncts.contains(conjunct)) {
+        conjuncts.add(conjunct);
+    }
+}
+
+// After:
+protected Set<Expr> conjunctSet = new LinkedHashSet<>();
+protected List<Expr> conjuncts = null; // lazy view, computed on demand
+
+public void addConjunct(Expr conjunct) {
+    conjunctSet.add(conjunct);  // O(1) via hashCode/equals
+}
+
+public List<Expr> getConjuncts() {
+    return new ArrayList<>(conjunctSet);
+}
+```
+
+If `Expr` does not implement `hashCode`/`equals`, a `LinkedHashMap<Expr, Boolean>`
+keyed by identity (`System.identityHashCode`) is the alternative.
+
+## Speedup
+
+| C (conjuncts) | addConjuncts calls | Before (ops) | After (ops) | Speedup |
+|---|---|---|---|---|
+| 20 | 20 | 400 | 20 | 20× |
+| 100 | 100 | 10,000 | 100 | 100× |
+| 500 | 500 | 250,000 | 500 | 500× |

defects/grafana/patch/CLEAN.md

@@ -1,19 +1,16 @@
 # grafana — CWE-407 Scan Result: CLEAN
 
-Scanned: 2026-03-29
+Scanned 2026-03-29.
 
-## Scope
+## Findings
 
-- `pkg/expr/` — expression pipeline DAG: uses `gonum/graph/topo.SortStabilized` (proper topological
-  sort) and `gonum/graph/simple.DirectedGraph` (adjacency map). No O(N²) visited lists.
-- `pkg/plugins/` — plugin loading pipeline: uses `slices.Contains` only for small bounded slices
-  (plugin type lists, scopes). No inner loop.
-- `pkg/services/ngalert/` — alerting: list operations on alert rules all use `map[string]struct{}`
-  or `slices.Contains` outside loops.
-- `pkg/infra/filestorage/` — uses `map[string]bool` for visitedFolders (correct).
-- `pkg/build/wire/` — uses proper `map[*wire.ProviderSet]struct{}` visited set.
+`FolderTree.Contains` uses a map index (O(1)). `ResourcePermission.Contains` is
+O(|Actions| × |targetActions|) but both are small fixed permission sets (< 20 items)
+and the function is not called in a tight loop over large collections.
 
-## Verdict
+`ManagedRoutes.Contains` is a linear scan but is not called in an outer loop.
 
-No CWE-407 defects found. Grafana's dependency graph resolution uses the gonum library which
-implements proper O(E + V log V) algorithms throughout.
+`Wildcards.Contains` walks a sorted slice of wildcard scopes — bounded by the number
+of resource permission types (< 50).
+
+**Verdict: CLEAN** — no CWE-407 defects warranting a patch.

defects/helm/patch/helm-0001-resourcelist-contains-map.md

@@ -0,0 +1,124 @@
+# UNDF: UNDF-2026-000000232
+# UNDF: (pending)
+# helm-0001: ResourceList.Contains/Difference/Intersect — O(N²) linear scan
+
+## CWE-407 — Algorithmic Complexity
+
+| Field | Value |
+|-------|-------|
+| ID | helm-0001 |
+| Severity | MEDIUM |
+| Ecosystem | helm |
+| Package | pkg/kube |
+| File | `pkg/kube/resource.go` |
+| Lines | 61–79 |
+| Complexity | O(N²) — Difference/Intersect each call Contains O(N) per element |
+| Hot path | `helm upgrade` resource reconciliation — deletes resources not in new manifest |
+
+## Defect
+
+`ResourceList.Contains()` is a linear scan over all resources:
+
+```go
+func (r ResourceList) Contains(info *resource.Info) bool {
+    for _, i := range r {
+        if isMatchingInfo(i, info) {
+            return true
+        }
+    }
+    return false
+}
+```
+
+`Difference` and `Intersect` call `Contains` inside a `Filter` loop, which iterates
+over the full list:
+
+```go
+func (r ResourceList) Difference(rs ResourceList) ResourceList {
+    return r.Filter(func(info *resource.Info) bool {
+        return !rs.Contains(info)   // O(|rs|) per element of r
+    })
+}
+
+func (r ResourceList) Intersect(rs ResourceList) ResourceList {
+    return r.Filter(rs.Contains)   // O(|rs|) per element of r
+}
+```
+
+`Filter` iterates over `r`:
+
+```go
+func (r ResourceList) Filter(fn func(*resource.Info) bool) ResourceList {
+    var result ResourceList
+    for _, v := range r {
+        if fn(v) {
+            result = append(result, v)
+        }
+    }
+    return result
+}
+```
+
+At `helm upgrade` time, `client.go:648` calls `originals.Difference(targets)` to find
+resources to delete. With N=200 resources, this costs 200×200 = 40,000 equality checks
+instead of 200 map lookups.
+
+`isMatchingInfo` compares Name+Namespace+Group+Kind — uniquely identifies a resource,
+making it suitable as a map key.
+
+## Fix
+
+Build an index set from `rs` before filtering:
+
+```go
+// resourceKey returns a unique string key for a resource.Info.
+func resourceKey(info *resource.Info) string {
+    return fmt.Sprintf("%s/%s/%s/%s",
+        info.Mapping.GroupVersionKind.Group,
+        info.Mapping.GroupVersionKind.Kind,
+        info.Namespace,
+        info.Name,
+    )
+}
+
+func (r ResourceList) Contains(info *resource.Info) bool {
+    for _, i := range r {
+        if isMatchingInfo(i, info) {
+            return true
+        }
+    }
+    return false
+}
+
+// Difference returns resources in r not in rs. O(|r| + |rs|) with index.
+func (r ResourceList) Difference(rs ResourceList) ResourceList {
+    index := make(map[string]struct{}, len(rs))
+    for _, i := range rs {
+        index[resourceKey(i)] = struct{}{}
+    }
+    return r.Filter(func(info *resource.Info) bool {
+        _, found := index[resourceKey(info)]
+        return !found
+    })
+}
+
+// Intersect returns resources in both r and rs. O(|r| + |rs|) with index.
+func (r ResourceList) Intersect(rs ResourceList) ResourceList {
+    index := make(map[string]struct{}, len(rs))
+    for _, i := range rs {
+        index[resourceKey(i)] = struct{}{}
+    }
+    return r.Filter(func(info *resource.Info) bool {
+        _, found := index[resourceKey(info)]
+        return found
+    })
+}
+```
+
+## Speedup
+
+| N (resources) | Before (ops) | After (ops) | Speedup |
+|---|---|---|---|
+| 50 | 2,500 | 100 | 25× |
+| 200 | 40,000 | 400 | 100× |
+| 500 | 250,000 | 1,000 | 250× |

defects/nifi/patch/CLEAN.md

@@ -0,0 +1,17 @@
+# nifi — CWE-407 Scan Result: CLEAN
+
+Scanned 2026-03-29.
+
+## Findings
+
+`StandardControllerServiceReference.findRecursiveReferences` uses `HashSet<ControllerServiceNode>`
+as the visited guard — O(1) lookup. All `contains()` calls on `missingComponentIds`,
+`versionedClientIds`, etc. operate on `Set<String>` (HashSet-backed) or `List<String>`
+with small bounded sizes (reporting tasks, registry clients — typically < 50).
+
+`AbstractPolicyBasedAuthorizer` calls `policy.getUsers().contains(...)` but `getUsers()`
+returns a `Set<String>` per policy (confirmed by interface contract).
+
+No graph traversal with ArrayList visited sets found.
+
+**Verdict: CLEAN** — no CWE-407 defects warranting a patch.

defects/samza/patch/CLEAN.md

@@ -1,21 +1,15 @@
-# CLEAN — Apache Samza
-Scanned 2026-03-29 for CWE-407.
+# samza — CWE-407 Scan Result: CLEAN
 
-## Scope
-
-- `samza-core/src/main/java` — JobGraph, JobNode, IntermediateStreamManager, StandbyContainerManager, BlobStoreUtil, DirDiffUtil
+Scanned 2026-03-29.
 
 ## Findings
 
-| Location | Pattern | Type | Result |
-|----------|---------|------|--------|
-| `JobGraph.findReachable` | `visited.contains` in BFS | `HashSet<JobNode>` | CLEAN |
-| `JobGraph.topologicalSort` | `visited.contains` | `HashSet<JobNode>` | CLEAN |
-| `JobNode.findReachableOperators` | `reachableOperators.contains` | `Set<OperatorSpec>` | CLEAN |
-| `IntermediateStreamManager.processedStreamSets` | `contains` in stream filter | `HashSet<StreamSet>` | CLEAN |
-| `DirDiffUtil.filesToIgnore` | `contains` in stream filter | `Set<String>` parameter | CLEAN |
-| `StandbyContainerManager.standbySamzaContainerIds` | `contains` | Field type verified as `Set` | CLEAN |
+`JobGraph.findReachable()` and `topologicalSort()` use `HashSet<JobNode>` for visited
+tracking. `JobNode.findReachableOperators()` uses `Set<OperatorSpec>` (HashSet).
+`PollingScanDiskSpaceMonitor.getSpaceUsed()` uses `Set<Path>` (HashSet).
+`GroupByContainerIds.group()` uses `Set<TaskName>` (HashSet) for `assignedTasks`.
+`IntermediateStreamManager` uses `Set<StreamSet>` (HashSet) for `processedStreamSets`.
 
-All graph traversal, BFS, and deduplication patterns use `HashSet` or `Set`-typed collections throughout.
+No ArrayList-based visited/seen patterns found.
 
-**Result: No actionable CWE-407 defects.**
+**Verdict: CLEAN** — no CWE-407 defects warranting a patch.

defects/traefik/patch/CLEAN.md

@@ -0,0 +1,14 @@
+# traefik — CWE-407 Scan Result: CLEAN
+
+Scanned 2026-03-29.
+
+## Findings
+
+All `slices.Contains` / `slices.ContainsFunc` calls operate on small bounded sets:
+allowed encodings (< 10), connection header names (< 5), ingress class lists
+(bounded by cluster config), retry condition keywords (< 10).
+
+No custom slice-contains helpers in hot paths. No O(N²) traversal patterns found
+in router, middleware, or provider code.
+
+**Verdict: CLEAN** — no CWE-407 defects warranting a patch.

defects/victoria-metrics/patch/CLEAN.md

@@ -0,0 +1,14 @@
+# victoria-metrics — CWE-407 Scan Result: CLEAN
+
+Scanned 2026-03-29.
+
+## Findings
+
+VictoriaMetrics is heavily performance-oriented. Core data structures use sorted
+arrays with binary search (mergeset, storage index), hash maps for dedup, and
+pool-based allocation. No custom `contains`-over-slice patterns found in
+`lib/storage`, `lib/mergeset`, `lib/streamaggr`, or `lib/storage/index`.
+
+Vendor code excluded from scan.
+
+**Verdict: CLEAN** — no CWE-407 defects warranting a patch.