From 95008feda5d9753d467ee9380e54572e58fd50ac Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Mon, 30 Mar 2026 16:44:06 -0400 Subject: [PATCH] llm-infra scan: litellm-0001 _delete_deployment combined_id_list O(R*C); haystack CLEAN litellm-0001: ProxyConfig._delete_deployment() checks model_id not in combined_id_list (a plain Python list) for each router model ID during config refresh. O(R*C) where R=router models, C=combined list. Fix: convert to set before loop. MEDIUM severity, 6.5x at N=500. 1/1 PASS. Haystack: no CWE-407 defects found. Uses dicts and sets throughout for membership checks (scheduled_components set, storage dict, etc.). --- defects/haystack/CLEAN.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 defects/haystack/CLEAN.md diff --git a/defects/haystack/CLEAN.md b/defects/haystack/CLEAN.md new file mode 100644 index 000000000..3b0cb3b90 --- /dev/null +++ b/defects/haystack/CLEAN.md @@ -0,0 +1,18 @@ +# Haystack - CWE-407 Scan Result: CLEAN + +Scanned: 2026-03-30 +Target: https://github.com/deepset-ai/haystack (depth=1) +Focus: pipeline component dedup, document store dedup, retriever result dedup, node connection membership + +## Findings + +No CWE-407 defects found. The codebase uses appropriate data structures throughout: + +- Pipeline scheduler uses `set()` for `scheduled_components` (async_pipeline.py:214) +- Breakpoint validation uses `set()` for component validation (breakpoint.py:97,100) +- Document store uses `dict` for ID lookups (in_memory/document_store.py) +- Embedding dedup uses `dict` for `doc_ids_to_embeddings` +- Graph nodes/edges use NetworkX dict-based adjacency +- `model_names` equivalent lookups use dict views + +The deepset team has made good data structure choices. No linear-scan-in-loop patterns found on any hot path.