engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

diamond-scan: spring/hibernate/weld/quarkus/micronaut O(2^D) hierarchy traversal

Browse source 
5 new defects across 5 repos — all diamond recursion (map/set .put/.add return
value ignored before unconditional recurse):

- spring-0001: AnnotationsScanner.processClassHierarchy TYPE_HIERARCHY mode,
  no visited guard, used by every @Transactional/@Autowired/@RequestMapping scan
- hibernate-0001: ClassHierarchyHelper.getImplementedInterfaces, Set.add()
  return ignored before unconditional recurse — hibernate-validator
- weld-0004: HierarchyDiscovery.discoverTypes, HashMap.put() return ignored,
  CDI bean type closure discovery at startup
- quarkus-0004: HierarchyDiscovery.discoverTypes (ArC, copied from Weld),
  same defect — Quarkus startup + native image
- micronaut-0005: NativeElementsHelper.populateTypeHierarchy, no visited guard
- micronaut-0006: GenericUtils.populateTypeArgumentsForInterfaces, recursion
  outside containsKey guard

Also rename cpython-0001→0002, 0002→0003, 0003→0004 (pre-existing renumber).
This commit is contained in:
russell@unturf.com 2026-03-29 20:17:52 -04:00
parent 4d4c256673
commit 9d273094e8
9 changed files with 607 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
defects/cpython/patch/cpython-0001-pydoc-allmethods-diamond-bases.md → defects/cpython/patch/cpython-0002-pydoc-allmethods-diamond-bases.md
View file

@ -1,11 +1,11 @@
# UNDF: (pending)
# cpython-0001: pydoc.allmethods — O(2^D) diamond base traversal
# cpython-0002: pydoc.allmethods — O(2^D) diamond base traversal
## CWE-407 — Algorithmic Complexity: O(2^D) diamond mixin/base traversal
| Field | Value |
|-------|-------|
| ID | cpython-0001 |
| ID | cpython-0002 |
| Severity | MEDIUM |
| Ecosystem | cpython |
| Package | pydoc |

4
defects/cpython/patch/cpython-0002-turtle-methoddict-diamond-bases.md → defects/cpython/patch/cpython-0003-turtle-methoddict-diamond-bases.md
View file

@ -1,11 +1,11 @@
# UNDF: (pending)
# cpython-0002: turtle.__methodDict — O(2^D) diamond base traversal
# cpython-0003: turtle.__methodDict — O(2^D) diamond base traversal
## CWE-407 — Algorithmic Complexity: O(2^D) diamond mixin/base traversal
| Field | Value |
|-------|-------|
| ID | cpython-0002 |
| ID | cpython-0003 |
| Severity | MEDIUM |
| Ecosystem | cpython |
| Package | turtle |

4
defects/cpython/patch/cpython-0003-idlelib-rpc-getmethods-diamond-bases.md → defects/cpython/patch/cpython-0004-idlelib-rpc-getmethods-diamond-bases.md
View file

@ -1,11 +1,11 @@
# UNDF: (pending)
# cpython-0003: idlelib.rpc._getmethods — O(2^D) diamond base traversal
# cpython-0004: idlelib.rpc._getmethods — O(2^D) diamond base traversal
## CWE-407 — Algorithmic Complexity: O(2^D) diamond mixin/base traversal
| Field | Value |
|-------|-------|
| ID | cpython-0003 |
| ID | cpython-0004 |
| Severity | MEDIUM |
| Ecosystem | cpython |
| Package | idlelib.rpc |