engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

flink-deeper/storm: CWE-407 findings

Browse source 
flink-0006: MultipleInputNodeCreationProcessor.createMultipleInputNode() group.members ArrayList.contains inside nested loop O(M2*I); fix: HashSet membersSet before loop
flink-0007: MLPredictTypeStrategy.validateTableAndDescriptorArguments() tableFieldNames List<String>.contains in for loop O(D*T); fix: HashSet<String> conversion before loop
storm-0001: WorkerState.refreshConnections() localTaskIds ArrayList<Integer>.contains in per-task loop O(T_out*L); fix: change to HashSet<Integer>
This commit is contained in:
russell@unturf.com 2026-03-30 09:52:27 -04:00
parent cb15f957b5
commit b31ac644bb
5 changed files with 364 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

27
defects/flink/patch/flink-0006-multiple-input-node-members-set.patch Normal file
View file

@ -0,0 +1,27 @@
# UNDF: (leave blank)
--- a/flink-table/flink-table-planner/src/main/java/org/apache/flink/table/planner/plan/nodes/exec/processor/MultipleInputNodeCreationProcessor.java
+++ b/flink-table/flink-table-planner/src/main/java/org/apache/flink/table/planner/plan/nodes/exec/processor/MultipleInputNodeCreationProcessor.java
@@ -534,7 +534,7 @@ public class MultipleInputNodeCreationProcessor implements DAGProcessor {
// calculate the inputs of the multiple input node
List<Tuple3<ExecNode<?>, InputProperty, ExecEdge>> inputs = new ArrayList<>();
+ Set<ExecNodeWrapper> membersSet = new HashSet<>(group.members);
for (ExecNodeWrapper member : group.members) {
for (int i = 0; i < member.inputs.size(); i++) {
ExecNodeWrapper memberInput = member.inputs.get(i);
- if (group.members.contains(memberInput)) {
+ if (membersSet.contains(memberInput)) {
continue;
}
@@ -705,10 +705,12 @@ public class MultipleInputNodeCreationProcessor implements DAGProcessor {
Preconditions.checkNotNull(
root, "Multiple input group does not have a root. This is a bug.");
- Set<ExecNodeWrapper> sameGroupInputWrappers = new HashSet<>();
+ Set<ExecNodeWrapper> membersSet = new HashSet<>(members);
+ Set<ExecNodeWrapper> sameGroupInputWrappers = new HashSet<>();
for (ExecNodeWrapper inputWrapper : root.inputs) {
- if (members.contains(inputWrapper)) {
+ if (membersSet.contains(inputWrapper)) {
sameGroupInputWrappers.add(inputWrapper);
}
}

11
defects/flink/patch/flink-0007-ml-predict-tablefieldnames-hashset.patch Normal file
View file

@ -0,0 +1,11 @@
# UNDF: (leave blank)
--- a/flink-table/flink-table-common/src/main/java/org/apache/flink/table/types/inference/strategies/MLPredictTypeStrategy.java
+++ b/flink-table/flink-table-common/src/main/java/org/apache/flink/table/types/inference/strategies/MLPredictTypeStrategy.java
@@ -165,7 +165,7 @@ class MLPredictTypeStrategy implements TypeStrategy {
// Check that descriptor column names exist in table columns
- List<String> tableFieldNames = DataType.getFieldNames(tableSemantics.dataType());
+ Set<String> tableFieldNames = new HashSet<>(DataType.getFieldNames(tableSemantics.dataType()));
List<String> descriptorColumnNames = descriptorColumns.getNames();
for (String descriptorColumnName : descriptorColumnNames) {
if (!tableFieldNames.contains(descriptorColumnName)) {