engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undf: stamp patches, update registry to 792

Browse source
This commit is contained in:
russell@unturf.com 2026-03-30 11:15:59 -04:00
parent bf6a727f08
commit b5c2a3d989
9 changed files with 224 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

40
defects/beam/patch/CLEAN.md
View file

@ -1,25 +1,27 @@
# CLEAN — Apache Beam
Scanned 2026-03-29 for CWE-407.
# Apache Beam — CWE-407 Scan Result: CLEAN
## Scope
**Date:** 2026-03-30
**Scanner:** agent blackops
**Scope:** sdks/java/core/src/main/java/, runners/
- `sdks/java/core/src/main/java` — PCollection DAG, PTransform graph, GreedyStageFuser
- `runners/core-java/src/main/java` — InMemoryStateInternals, SimplePushbackSideInputDoFnRunner, WatermarkHold
- `runners/google-cloud-dataflow-java/src/main/java` — DataflowRunner, DataflowPipelineTranslator
- `runners/google-cloud-dataflow-java/worker/src/main/java` — WindmillOrderedList
- `runners/jet/src/main/java` — DAGBuilder
## Summary
## Findings
Apache Beam's Java SDK and runners are clean of CWE-407 algorithmic complexity
defects. The codebase consistently uses HashSet/LinkedHashSet for membership
tests in graph traversal, pipeline fusion, and transform hierarchy operations.
| Location | Pattern | Type | Result |
|----------|---------|------|--------|
| `GreedyStageFuser` | `fusedCollections.contains` / `materializedPCollections.contains` | `LinkedHashSet` | CLEAN |
| `DAGBuilder.sideInputCollections` | `contains` per edge | `HashSet<String>` | CLEAN |
| `WindmillOrderedList.pendingDeletes` | `contains` in stream filter | `TreeRangeSet` (O(log N)) | CLEAN |
| `DataflowRunner.experiments` | `experiments.contains(...)` | `List<String>` — called at job-submission time (once), not in hot loop | LOW — startup only |
| `InMemoryStateInternals.contents` | `contains` | `Set` interface (HashSet impl) | CLEAN |
| `SideInputHandler.readyWindows` | `contains` | `CopyOnWriteArraySet` | CLEAN |
## Key observations
The `DataflowRunner.experiments` pattern makes several `List<String>.contains` calls during job submission — a one-time initialization path, not a per-record or per-traversal hot path. Not actionable as CWE-407.
- `GreedyStageFuser`: uses `LinkedHashSet` for fusedCollections/materializedPCollections
- `GreedyPipelineFuser`: uses `LinkedHashSet`/`HashSet` throughout; has O(N²) comment
at groupSiblings but this is inherent sibling compatibility checking, not a membership defect
- `Networks`: uses `visitedNodes` Set for BFS reachability
- `TransformHierarchy`: all visited tracking uses `Set<Node>`
- `PipelineTranslation`: viewTransforms is `HashSet<String>`
- `Schema.indexOf()`: backed by `fieldIndices` HashMap
- `PipelineOptionsFactory`: uses `HashSet` for usedDescriptors, `ImmutableSet` for IGNORED_METHODS
- `ExperimentContext`: uses `EnumSet` for experiment lookup
- `DataflowRunner.stageArtifacts`: uses `HashSet` for stagedNames dedup
- `CombineFns.checkUniqueness`: List.contains() but N is number of composed combiners (2-5)
**Result: No actionable CWE-407 defects.**
No data-proportional linear scans inside loops found.