engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

flink-deeper/storm: CWE-407 findings

Browse source 
flink-0006: MultipleInputNodeCreationProcessor.createMultipleInputNode() group.members ArrayList.contains inside nested loop O(M2*I); fix: HashSet membersSet before loop
flink-0007: MLPredictTypeStrategy.validateTableAndDescriptorArguments() tableFieldNames List<String>.contains in for loop O(D*T); fix: HashSet<String> conversion before loop
storm-0001: WorkerState.refreshConnections() localTaskIds ArrayList<Integer>.contains in per-task loop O(T_out*L); fix: change to HashSet<Integer>
This commit is contained in:
russell@unturf.com 2026-03-30 09:52:27 -04:00
parent cb15f957b5
commit b31ac644bb
5 changed files with 364 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

27
defects/storm/patch/storm-0001-worker-localtaskids-hashset.patch Normal file
View file

@ -0,0 +1,27 @@
# UNDF: (leave blank)
--- a/storm-client/src/jvm/org/apache/storm/daemon/worker/WorkerState.java
+++ b/storm-client/src/jvm/org/apache/storm/daemon/worker/WorkerState.java
@@ -109,7 +109,7 @@ public class WorkerState {
// local executors and localTaskIds running in this worker
- final ArrayList<Integer> localTaskIds;
+ final Set<Integer> localTaskIds;
@@ -190,7 +190,7 @@ public class WorkerState {
- this.localTaskIds = new ArrayList<>();
+ this.localTaskIds = new HashSet<>();
for (List<Long> executor : executors) {
List<Integer> taskIds = StormCommon.executorIdToTasks(executor);
this.localTaskIds.addAll(taskIds);
}
- Collections.sort(localTaskIds);
@@ -424,7 +424,7 @@ public class WorkerState {
for (Map.Entry<Integer, NodeInfo> taskToNodePortEntry : taskToNodePort.entrySet()) {
Integer task = taskToNodePortEntry.getKey();
if (outboundTasks.contains(task)) {
newTaskToNodePort.put(task, taskToNodePortEntry.getValue());
- if (!localTaskIds.contains(task)) {
+ if (!localTaskIds.contains(task)) { /* O(1) now that localTaskIds is HashSet */
neededConnections.add(taskToNodePortEntry.getValue());
}
}