engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN

Browse source 
consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet

6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza
This commit is contained in:
russell@unturf.com 2026-03-29 19:54:13 -04:00
parent cfed6f1c5b
commit 5b5355cb07
11 changed files with 479 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

14
defects/traefik/patch/CLEAN.md Normal file
View file

@ -0,0 +1,14 @@
# traefik — CWE-407 Scan Result: CLEAN
Scanned 2026-03-29.
## Findings
All `slices.Contains` / `slices.ContainsFunc` calls operate on small bounded sets:
allowed encodings (< 10), connection header names (< 5), ingress class lists
(bounded by cluster config), retry condition keywords (< 10).
No custom slice-contains helpers in hot paths. No O(N²) traversal patterns found
in router, middleware, or provider code.
**Verdict: CLEAN** — no CWE-407 defects warranting a patch.