From 5b5355cb075cd77972cb19a70b0f4ccd3d1fc537 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Sun, 29 Mar 2026 19:54:13 -0400 Subject: [PATCH] infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{} helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet 6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza --- defects/buildkit/patch/CLEAN.md | 19 ++- ...nsul-0001-mesh-gateway-peername-hashset.md | 94 +++++++++++++ defects/containerd/patch/CLEAN.md | 21 ++- ...equivalence-class-list-contains-hashset.md | 78 +++++++++++ ...s-0002-plannode-conjuncts-linkedhashset.md | 101 ++++++++++++++ defects/grafana/patch/CLEAN.md | 23 ++-- .../helm-0001-resourcelist-contains-map.md | 124 ++++++++++++++++++ defects/nifi/patch/CLEAN.md | 17 +++ defects/samza/patch/CLEAN.md | 24 ++-- defects/traefik/patch/CLEAN.md | 14 ++ defects/victoria-metrics/patch/CLEAN.md | 14 ++ 11 files changed, 479 insertions(+), 50 deletions(-) create mode 100644 defects/consul/patch/consul-0001-mesh-gateway-peername-hashset.md create mode 100644 defects/doris/patch/doris-0001-equivalence-class-list-contains-hashset.md create mode 100644 defects/doris/patch/doris-0002-plannode-conjuncts-linkedhashset.md create mode 100644 defects/helm/patch/helm-0001-resourcelist-contains-map.md create mode 100644 defects/nifi/patch/CLEAN.md create mode 100644 defects/traefik/patch/CLEAN.md create mode 100644 defects/victoria-metrics/patch/CLEAN.md diff --git a/defects/buildkit/patch/CLEAN.md b/defects/buildkit/patch/CLEAN.md index 199892178..6d533e62b 100644 --- a/defects/buildkit/patch/CLEAN.md +++ b/defects/buildkit/patch/CLEAN.md @@ -1,17 +1,14 @@ # buildkit — CWE-407 Scan Result: CLEAN -Scanned: 2026-03-29 +Scanned 2026-03-29. -## Scope +## Findings -- `cache/refs.go` — `walkBlobVariantsOnly`: uses `map[digest.Digest]struct{}` visited set. -- `cache/remotecache/v1/cachestorage.go` — `addItemToStorage`: uses - `map[*item]*itemWithOutgoingLinks` visited guard. -- `cache/remotecache/v1/parse.go` — `getRemoteChain`: uses `map[int]struct{}` visited set. -- `cache/remote.go` — `slices.ContainsFunc` / `slices.Contains`: used on small bounded - descriptor/repo slices, not in hot nested loops over the full layer graph. +No custom slice-contains helpers. `slices.Contains` and `slices.ContainsFunc` used +in bounded contexts (compression type checks, platform filtering, annotation +repository dedup per descriptor — the `existingRepos` list is rebuilt from +comma-separated annotations per descriptor, not accumulated across descriptors). -## Verdict +Graph traversal in `remotecache/v1/parse.go` uses a `map[int]struct{}` visited set. -No CWE-407 defects found. buildkit's build graph and layer cache traversal use proper -hash-map visited structures. +**Verdict: CLEAN** — no CWE-407 defects warranting a patch. diff --git a/defects/consul/patch/consul-0001-mesh-gateway-peername-hashset.md b/defects/consul/patch/consul-0001-mesh-gateway-peername-hashset.md new file mode 100644 index 000000000..2677de658 --- /dev/null +++ b/defects/consul/patch/consul-0001-mesh-gateway-peername-hashset.md @@ -0,0 +1,94 @@ +# UNDF: UNDF-2026-000000090 +# UNDF: (pending) +# consul-0001: makeMeshGatewayPeerFilterChain — peerNames O(S×B×P) slice lookup + +## CWE-407 — Algorithmic Complexity + +| Field | Value | +|-------|-------| +| ID | consul-0001 | +| Severity | MEDIUM | +| Ecosystem | consul | +| Package | agent/xds | +| File | `agent/xds/listeners.go` | +| Lines | 2282–2286 | +| Complexity | O(S×B×P) — services × bundles × peers per service | +| Hot path | Mesh gateway listener rebuild on every topology change | + +## Defect + +`makeMeshGatewayPeerFilterChain` receives `peerNames []string` (the set of peer names +for this exported service) and iterates over all peering trust bundles, calling +`stringslice.Contains(peerNames, bundle.PeerName)` for each bundle: + +```go +// agent/xds/listeners.go +for _, bundle := range cfgSnap.MeshGateway.PeeringTrustBundles { // O(B) + if stringslice.Contains(peerNames, bundle.PeerName) { // O(P) scan + peerBundles = append(peerBundles, bundle) + } +} +``` + +`stringslice.Contains` is a linear scan: + +```go +// lib/stringslice/stringslice.go +func Contains(l []string, s string) bool { + for _, v := range l { + if v == s { + return true + } + } + return false +} +``` + +The outer caller iterates over all exported services: + +```go +for _, svc := range cfgSnap.MeshGatewayValidExportedServices() { // O(S) + peerNames := cfgSnap.MeshGateway.ExportedServicesWithPeers[svc] + filterChain, err := s.makeMeshGatewayPeerFilterChain(cfgSnap, svc, peerNames, chain) +``` + +Total: O(S × B × P). In a production Consul cluster with S=50 services, B=20 trust +bundles, P=20 peers per service, each listener rebuild costs 50×20×20 = 20,000 +string comparisons instead of 50×20 = 1,000 map lookups. + +## Fix + +Convert `peerNames` to a `map[string]bool` before the bundle loop: + +```go +// Before: +var peerBundles []*pbpeering.PeeringTrustBundle +for _, bundle := range cfgSnap.MeshGateway.PeeringTrustBundles { + if stringslice.Contains(peerNames, bundle.PeerName) { + peerBundles = append(peerBundles, bundle) + } +} + +// After: +peerNameSet := make(map[string]struct{}, len(peerNames)) +for _, p := range peerNames { + peerNameSet[p] = struct{}{} +} +var peerBundles []*pbpeering.PeeringTrustBundle +for _, bundle := range cfgSnap.MeshGateway.PeeringTrustBundles { + if _, ok := peerNameSet[bundle.PeerName]; ok { + peerBundles = append(peerBundles, bundle) + } +} +``` + +Alternatively, `ExportedServicesWithPeers` could store `map[string]struct{}` instead of +`[]string`, propagating O(1) lookup to all callers. + +## Speedup + +| S (services) | B (bundles) | P (peers) | Before (ops) | After (ops) | Speedup | +|---|---|---|---|---|---| +| 10 | 10 | 10 | 1,000 | 200 | 5× | +| 50 | 20 | 20 | 20,000 | 2,000 | 10× | +| 100 | 50 | 50 | 250,000 | 10,000 | 25× | diff --git a/defects/containerd/patch/CLEAN.md b/defects/containerd/patch/CLEAN.md index 0a6a71dca..fb1676ee6 100644 --- a/defects/containerd/patch/CLEAN.md +++ b/defects/containerd/patch/CLEAN.md @@ -1,17 +1,16 @@ # containerd — CWE-407 Scan Result: CLEAN -Scanned: 2026-03-29 +Scanned 2026-03-29. -## Scope +## Findings -- `cache/refs.go` — `walkUniqueAncestors`/`walkBlobVariantsOnly`: uses - `map[digest.Digest]struct{}` visited set for layer graph traversal. Correct O(V+E). -- `cache/remotecache/v1/` — `addItemToStorage`, `getRemoteChain`: both use - `map[*item]*itemWithOutgoingLinks` / `map[int]struct{}` visited guards. Correct. -- All `slices.Contains` call sites: used on small bounded option/capability slices - (mount options, platform lists), never inside a per-item outer loop. +`slices.Contains` is used in several paths (mount options, capabilities, snapshotter +capabilities, platform lists) but all target lists are small and bounded (typically +< 10 elements): mount option flags, GID lists, network namespace types. -## Verdict +No O(N²) patterns in hot paths (content ingestion, snapshot chain management, +layer unpacking). The `cacheResultStorage.HasLink()` in `remotecache/v1/cachestorage.go` +calls `slices.Contains(it.links[l], target)` but `it.links[l]` is a deduplicated +list of cache targets per link key — bounded in practice. -No CWE-407 defects found. containerd's layer deduplication and cache traversal use -proper hash-map visited guards. +**Verdict: CLEAN** — no CWE-407 defects warranting a patch. diff --git a/defects/doris/patch/doris-0001-equivalence-class-list-contains-hashset.md b/defects/doris/patch/doris-0001-equivalence-class-list-contains-hashset.md new file mode 100644 index 000000000..1b729f679 --- /dev/null +++ b/defects/doris/patch/doris-0001-equivalence-class-list-contains-hashset.md @@ -0,0 +1,78 @@ +# UNDF: UNDF-2026-000000381 +# UNDF: (pending) +# doris-0001: EquivalenceClass.getEquivalenceSetList — O(N²) List.contains dedup + +## CWE-407 — Algorithmic Complexity + +| Field | Value | +|-------|-------| +| ID | doris-0001 | +| Severity | MEDIUM | +| Ecosystem | doris | +| Package | fe-core | +| File | `fe/fe-core/src/main/java/org/apache/doris/nereids/rules/exploration/mv/EquivalenceClass.java` | +| Lines | 130–146 | +| Complexity | O(N²) | +| Hot path | Called during materialized view rewrite in query planning (every query with MV candidates) | + +## Defect + +`getEquivalenceSetList()` deduplicates equivalence class lists using a `List>` +as the visited set. `visited.contains(slotSet)` calls `ArrayList.contains()` which iterates the +entire visited list comparing lists element-by-element — O(N) per call. The outer loop also +iterates N times, making the total complexity O(N²) where N is the number of distinct equivalence +slot lists in `equivalenceSlotMap.values()`. + +This runs on every query that touches materialized view rewrite logic in Doris Nereids. + +```java +public List> getEquivalenceSetList() { + if (equivalenceSlotList != null) { + return equivalenceSlotList; + } + List> equivalenceSets = new ArrayList<>(); + List> visited = new ArrayList<>(); // O(N) per contains + equivalenceSlotMap.values().forEach(slotSet -> { + if (!visited.contains(slotSet)) { // O(N) scan + equivalenceSets.add(slotSet); + } + visited.add(slotSet); + }); + this.equivalenceSlotList = equivalenceSets; + return this.equivalenceSlotList; +} +``` + +## Fix + +`equivalenceSlotMap` maps each `SlotReference` to its equivalence-class list (which is a shared +`List` object). Deduplication by object identity is sufficient and correct because +the union-find structure ensures all members of an equivalence class share the same list reference. +Use `IdentityHashMap` or `Set` based on object identity: + +```java +public List> getEquivalenceSetList() { + if (equivalenceSlotList != null) { + return equivalenceSlotList; + } + // Use identity comparison: all slots in the same equivalence class share the same List object + Set> seen = Collections.newSetFromMap(new IdentityHashMap<>()); + List> equivalenceSets = new ArrayList<>(); + for (List slotSet : equivalenceSlotMap.values()) { + if (seen.add(slotSet)) { // O(1) identity hash + equivalenceSets.add(slotSet); + } + } + this.equivalenceSlotList = equivalenceSets; + return this.equivalenceSlotList; +} +``` + +## Speedup + +| N (equivalence classes) | Before (ops) | After (ops) | Speedup | +|-------------------------|-------------|-------------|---------| +| 10 | 100 | 10 | 10× | +| 50 | 2,500 | 50 | 50× | +| 100 | 10,000 | 100 | 100× | +| 500 | 250,000 | 500 | 500× | diff --git a/defects/doris/patch/doris-0002-plannode-conjuncts-linkedhashset.md b/defects/doris/patch/doris-0002-plannode-conjuncts-linkedhashset.md new file mode 100644 index 000000000..1faac6ac0 --- /dev/null +++ b/defects/doris/patch/doris-0002-plannode-conjuncts-linkedhashset.md @@ -0,0 +1,101 @@ +# UNDF: (pending) +# doris-0002: PlanNode.addConjunct — ArrayList.contains() O(C²) dedup + +## CWE-407 — Algorithmic Complexity + +| Field | Value | +|-------|-------| +| ID | doris-0002 | +| Severity | MEDIUM | +| Ecosystem | doris | +| Package | fe-core/planner | +| File | `fe/fe-core/src/main/java/org/apache/doris/planner/PlanNode.java` | +| Lines | 308–324 | +| Complexity | O(C²) — C conjuncts, each `addConjuncts()` call scans the list | +| Hot path | Query planning — `addConjunctsToPlanNode` in PhysicalPlanTranslator | + +## Defect + +`PlanNode.conjuncts` is an `ArrayList`. The `addConjunct` method deduplicates +by calling `ArrayList.contains()`, which is O(C): + +```java +// PlanNode.java +protected List conjuncts = Lists.newArrayList(); + +public void addConjuncts(List conjuncts) { + if (conjuncts == null) return; + for (Expr conjunct : conjuncts) { // O(C_new) + addConjunct(conjunct); + } +} + +public void addConjunct(Expr conjunct) { + if (conjuncts == null) { + conjuncts = Lists.newArrayList(); + } + if (!conjuncts.contains(conjunct)) { // O(C_existing) scan + conjuncts.add(conjunct); + } +} +``` + +`PhysicalPlanTranslator.addConjunctsToPlanNode` calls this from a double loop: + +```java +// PhysicalPlanTranslator.java:3039-3047 +private void addConjunctsToPlanNode(PhysicalFilter filter, + PlanNode planNode, PlanTranslatorContext context) { + for (Expression conjunct : filter.getConjuncts()) { // O(F) + for (Expression singleConjunct : ExpressionUtils.extractConjunctionToSet(conjunct)) { // O(K) + planNode.addConjunct(ExpressionTranslator.translate(singleConjunct, context)); // O(C) + } + } +} +``` + +Total: O(F × K × C) — with F=filter conjuncts, K=sub-conjuncts per predicate, +C=existing conjuncts in node. At C=100 conjuncts, each `addConjunct` call costs +100 equality comparisons instead of O(1). + +## Fix + +Replace `conjuncts` with a `LinkedHashSet` (preserves insertion order, +O(1) contains): + +```java +// Before: +protected List conjuncts = Lists.newArrayList(); + +public void addConjunct(Expr conjunct) { + if (conjuncts == null) { + conjuncts = Lists.newArrayList(); + } + if (!conjuncts.contains(conjunct)) { + conjuncts.add(conjunct); + } +} + +// After: +protected Set conjunctSet = new LinkedHashSet<>(); +protected List conjuncts = null; // lazy view, computed on demand + +public void addConjunct(Expr conjunct) { + conjunctSet.add(conjunct); // O(1) via hashCode/equals +} + +public List getConjuncts() { + return new ArrayList<>(conjunctSet); +} +``` + +If `Expr` does not implement `hashCode`/`equals`, a `LinkedHashMap` +keyed by identity (`System.identityHashCode`) is the alternative. + +## Speedup + +| C (conjuncts) | addConjuncts calls | Before (ops) | After (ops) | Speedup | +|---|---|---|---|---| +| 20 | 20 | 400 | 20 | 20× | +| 100 | 100 | 10,000 | 100 | 100× | +| 500 | 500 | 250,000 | 500 | 500× | diff --git a/defects/grafana/patch/CLEAN.md b/defects/grafana/patch/CLEAN.md index c42efa8c0..ec2f66e54 100644 --- a/defects/grafana/patch/CLEAN.md +++ b/defects/grafana/patch/CLEAN.md @@ -1,19 +1,16 @@ # grafana — CWE-407 Scan Result: CLEAN -Scanned: 2026-03-29 +Scanned 2026-03-29. -## Scope +## Findings -- `pkg/expr/` — expression pipeline DAG: uses `gonum/graph/topo.SortStabilized` (proper topological - sort) and `gonum/graph/simple.DirectedGraph` (adjacency map). No O(N²) visited lists. -- `pkg/plugins/` — plugin loading pipeline: uses `slices.Contains` only for small bounded slices - (plugin type lists, scopes). No inner loop. -- `pkg/services/ngalert/` — alerting: list operations on alert rules all use `map[string]struct{}` - or `slices.Contains` outside loops. -- `pkg/infra/filestorage/` — uses `map[string]bool` for visitedFolders (correct). -- `pkg/build/wire/` — uses proper `map[*wire.ProviderSet]struct{}` visited set. +`FolderTree.Contains` uses a map index (O(1)). `ResourcePermission.Contains` is +O(|Actions| × |targetActions|) but both are small fixed permission sets (< 20 items) +and the function is not called in a tight loop over large collections. -## Verdict +`ManagedRoutes.Contains` is a linear scan but is not called in an outer loop. -No CWE-407 defects found. Grafana's dependency graph resolution uses the gonum library which -implements proper O(E + V log V) algorithms throughout. +`Wildcards.Contains` walks a sorted slice of wildcard scopes — bounded by the number +of resource permission types (< 50). + +**Verdict: CLEAN** — no CWE-407 defects warranting a patch. diff --git a/defects/helm/patch/helm-0001-resourcelist-contains-map.md b/defects/helm/patch/helm-0001-resourcelist-contains-map.md new file mode 100644 index 000000000..30c0bb4f3 --- /dev/null +++ b/defects/helm/patch/helm-0001-resourcelist-contains-map.md @@ -0,0 +1,124 @@ +# UNDF: UNDF-2026-000000232 +# UNDF: (pending) +# helm-0001: ResourceList.Contains/Difference/Intersect — O(N²) linear scan + +## CWE-407 — Algorithmic Complexity + +| Field | Value | +|-------|-------| +| ID | helm-0001 | +| Severity | MEDIUM | +| Ecosystem | helm | +| Package | pkg/kube | +| File | `pkg/kube/resource.go` | +| Lines | 61–79 | +| Complexity | O(N²) — Difference/Intersect each call Contains O(N) per element | +| Hot path | `helm upgrade` resource reconciliation — deletes resources not in new manifest | + +## Defect + +`ResourceList.Contains()` is a linear scan over all resources: + +```go +func (r ResourceList) Contains(info *resource.Info) bool { + for _, i := range r { + if isMatchingInfo(i, info) { + return true + } + } + return false +} +``` + +`Difference` and `Intersect` call `Contains` inside a `Filter` loop, which iterates +over the full list: + +```go +func (r ResourceList) Difference(rs ResourceList) ResourceList { + return r.Filter(func(info *resource.Info) bool { + return !rs.Contains(info) // O(|rs|) per element of r + }) +} + +func (r ResourceList) Intersect(rs ResourceList) ResourceList { + return r.Filter(rs.Contains) // O(|rs|) per element of r +} +``` + +`Filter` iterates over `r`: + +```go +func (r ResourceList) Filter(fn func(*resource.Info) bool) ResourceList { + var result ResourceList + for _, v := range r { + if fn(v) { + result = append(result, v) + } + } + return result +} +``` + +At `helm upgrade` time, `client.go:648` calls `originals.Difference(targets)` to find +resources to delete. With N=200 resources, this costs 200×200 = 40,000 equality checks +instead of 200 map lookups. + +`isMatchingInfo` compares Name+Namespace+Group+Kind — uniquely identifies a resource, +making it suitable as a map key. + +## Fix + +Build an index set from `rs` before filtering: + +```go +// resourceKey returns a unique string key for a resource.Info. +func resourceKey(info *resource.Info) string { + return fmt.Sprintf("%s/%s/%s/%s", + info.Mapping.GroupVersionKind.Group, + info.Mapping.GroupVersionKind.Kind, + info.Namespace, + info.Name, + ) +} + +func (r ResourceList) Contains(info *resource.Info) bool { + for _, i := range r { + if isMatchingInfo(i, info) { + return true + } + } + return false +} + +// Difference returns resources in r not in rs. O(|r| + |rs|) with index. +func (r ResourceList) Difference(rs ResourceList) ResourceList { + index := make(map[string]struct{}, len(rs)) + for _, i := range rs { + index[resourceKey(i)] = struct{}{} + } + return r.Filter(func(info *resource.Info) bool { + _, found := index[resourceKey(info)] + return !found + }) +} + +// Intersect returns resources in both r and rs. O(|r| + |rs|) with index. +func (r ResourceList) Intersect(rs ResourceList) ResourceList { + index := make(map[string]struct{}, len(rs)) + for _, i := range rs { + index[resourceKey(i)] = struct{}{} + } + return r.Filter(func(info *resource.Info) bool { + _, found := index[resourceKey(info)] + return found + }) +} +``` + +## Speedup + +| N (resources) | Before (ops) | After (ops) | Speedup | +|---|---|---|---| +| 50 | 2,500 | 100 | 25× | +| 200 | 40,000 | 400 | 100× | +| 500 | 250,000 | 1,000 | 250× | diff --git a/defects/nifi/patch/CLEAN.md b/defects/nifi/patch/CLEAN.md new file mode 100644 index 000000000..09ec27699 --- /dev/null +++ b/defects/nifi/patch/CLEAN.md @@ -0,0 +1,17 @@ +# nifi — CWE-407 Scan Result: CLEAN + +Scanned 2026-03-29. + +## Findings + +`StandardControllerServiceReference.findRecursiveReferences` uses `HashSet` +as the visited guard — O(1) lookup. All `contains()` calls on `missingComponentIds`, +`versionedClientIds`, etc. operate on `Set` (HashSet-backed) or `List` +with small bounded sizes (reporting tasks, registry clients — typically < 50). + +`AbstractPolicyBasedAuthorizer` calls `policy.getUsers().contains(...)` but `getUsers()` +returns a `Set` per policy (confirmed by interface contract). + +No graph traversal with ArrayList visited sets found. + +**Verdict: CLEAN** — no CWE-407 defects warranting a patch. diff --git a/defects/samza/patch/CLEAN.md b/defects/samza/patch/CLEAN.md index 98af5121c..68fb7231d 100644 --- a/defects/samza/patch/CLEAN.md +++ b/defects/samza/patch/CLEAN.md @@ -1,21 +1,15 @@ -# CLEAN — Apache Samza -Scanned 2026-03-29 for CWE-407. +# samza — CWE-407 Scan Result: CLEAN -## Scope - -- `samza-core/src/main/java` — JobGraph, JobNode, IntermediateStreamManager, StandbyContainerManager, BlobStoreUtil, DirDiffUtil +Scanned 2026-03-29. ## Findings -| Location | Pattern | Type | Result | -|----------|---------|------|--------| -| `JobGraph.findReachable` | `visited.contains` in BFS | `HashSet` | CLEAN | -| `JobGraph.topologicalSort` | `visited.contains` | `HashSet` | CLEAN | -| `JobNode.findReachableOperators` | `reachableOperators.contains` | `Set` | CLEAN | -| `IntermediateStreamManager.processedStreamSets` | `contains` in stream filter | `HashSet` | CLEAN | -| `DirDiffUtil.filesToIgnore` | `contains` in stream filter | `Set` parameter | CLEAN | -| `StandbyContainerManager.standbySamzaContainerIds` | `contains` | Field type verified as `Set` | CLEAN | +`JobGraph.findReachable()` and `topologicalSort()` use `HashSet` for visited +tracking. `JobNode.findReachableOperators()` uses `Set` (HashSet). +`PollingScanDiskSpaceMonitor.getSpaceUsed()` uses `Set` (HashSet). +`GroupByContainerIds.group()` uses `Set` (HashSet) for `assignedTasks`. +`IntermediateStreamManager` uses `Set` (HashSet) for `processedStreamSets`. -All graph traversal, BFS, and deduplication patterns use `HashSet` or `Set`-typed collections throughout. +No ArrayList-based visited/seen patterns found. -**Result: No actionable CWE-407 defects.** +**Verdict: CLEAN** — no CWE-407 defects warranting a patch. diff --git a/defects/traefik/patch/CLEAN.md b/defects/traefik/patch/CLEAN.md new file mode 100644 index 000000000..7b492fb63 --- /dev/null +++ b/defects/traefik/patch/CLEAN.md @@ -0,0 +1,14 @@ +# traefik — CWE-407 Scan Result: CLEAN + +Scanned 2026-03-29. + +## Findings + +All `slices.Contains` / `slices.ContainsFunc` calls operate on small bounded sets: +allowed encodings (< 10), connection header names (< 5), ingress class lists +(bounded by cluster config), retry condition keywords (< 10). + +No custom slice-contains helpers in hot paths. No O(N²) traversal patterns found +in router, middleware, or provider code. + +**Verdict: CLEAN** — no CWE-407 defects warranting a patch. diff --git a/defects/victoria-metrics/patch/CLEAN.md b/defects/victoria-metrics/patch/CLEAN.md new file mode 100644 index 000000000..6552cee26 --- /dev/null +++ b/defects/victoria-metrics/patch/CLEAN.md @@ -0,0 +1,14 @@ +# victoria-metrics — CWE-407 Scan Result: CLEAN + +Scanned 2026-03-29. + +## Findings + +VictoriaMetrics is heavily performance-oriented. Core data structures use sorted +arrays with binary search (mergeset, storage index), hash maps for dedup, and +pool-based allocation. No custom `contains`-over-slice patterns found in +`lib/storage`, `lib/mergeset`, `lib/streamaggr`, or `lib/storage/index`. + +Vendor code excluded from scan. + +**Verdict: CLEAN** — no CWE-407 defects warranting a patch.