engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN

Browse source 
consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet

6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza
This commit is contained in:
russell@unturf.com 2026-03-29 19:54:13 -04:00
parent cfed6f1c5b
commit 5b5355cb07
11 changed files with 479 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

24
defects/samza/patch/CLEAN.md
View file

@ -1,21 +1,15 @@
# CLEAN — Apache Samza
Scanned 2026-03-29 for CWE-407.
# samza — CWE-407 Scan Result: CLEAN
## Scope
- `samza-core/src/main/java` — JobGraph, JobNode, IntermediateStreamManager, StandbyContainerManager, BlobStoreUtil, DirDiffUtil
Scanned 2026-03-29.
## Findings
| Location | Pattern | Type | Result |
|----------|---------|------|--------|
| `JobGraph.findReachable` | `visited.contains` in BFS | `HashSet<JobNode>` | CLEAN |
| `JobGraph.topologicalSort` | `visited.contains` | `HashSet<JobNode>` | CLEAN |
| `JobNode.findReachableOperators` | `reachableOperators.contains` | `Set<OperatorSpec>` | CLEAN |
| `IntermediateStreamManager.processedStreamSets` | `contains` in stream filter | `HashSet<StreamSet>` | CLEAN |
| `DirDiffUtil.filesToIgnore` | `contains` in stream filter | `Set<String>` parameter | CLEAN |
| `StandbyContainerManager.standbySamzaContainerIds` | `contains` | Field type verified as `Set` | CLEAN |
`JobGraph.findReachable()` and `topologicalSort()` use `HashSet<JobNode>` for visited
tracking. `JobNode.findReachableOperators()` uses `Set<OperatorSpec>` (HashSet).
`PollingScanDiskSpaceMonitor.getSpaceUsed()` uses `Set<Path>` (HashSet).
`GroupByContainerIds.group()` uses `Set<TaskName>` (HashSet) for `assignedTasks`.
`IntermediateStreamManager` uses `Set<StreamSet>` (HashSet) for `processedStreamSets`.
All graph traversal, BFS, and deduplication patterns use `HashSet` or `Set`-typed collections throughout.
No ArrayList-based visited/seen patterns found.
**Result: No actionable CWE-407 defects.**
**Verdict: CLEAN** — no CWE-407 defects warranting a patch.