# Apache Hive — CWE-407 Scan Result: CLEAN

**Date:** 2026-03-30
**Scanner:** agent blackops
**Scope:** ql/src/java/org/apache/hadoop/hive/ql/ (optimizer, parse, exec, metadata, plan)
         standalone-metastore/metastore-server/

## Summary

Apache Hive is clean of CWE-407 algorithmic complexity defects. The codebase
consistently uses HashSet for visited tracking, membership tests, and dedup
operations throughout the query optimizer, parser, compiler, and metastore.

## Key observations

- `OperatorGraph.Cluster.members`: HashSet<Operator<?>>
- `TezCompiler.unionOps`: HashSet<Operator<?>>
- `TezCompiler.connect()` (Tarjan SCC): uses `nodes` Set for stack membership
- `ColumnPrunerProcFactory`: HashSet for colNames membership
- `PipelineTranslation.viewTransforms`: HashSet<String>
- `SharedCache.*DeletedDuringPrewarm`: HashSet<String>
- `SessionHiveMetaStoreClient.partitionVals`: HashSet<List<String>> for partition dedup
- `Hive.createdDeltaDirs`: HashSet<Path> for ACID delta dir dedup
- `GreedyPipelineFuser`: acknowledged O(N²) in sibling grouping but this is inherent compatibility checking

Minor findings (no defect):
- `SemanticAnalyzer.leftAliases/rightAliases`: ArrayList with .contains(), but N is join alias count (2-3)
- `WindowingSpec.fillInWindowSpec.visited`: ArrayList with .contains(), but N is window spec chain depth (2-3)
- `QueryPlanTreeTransformation.childrenOfDemux`: List with .contains(), but N is demux children (2-3)
- `HiveRelDecorrelator.newLocalOutputs`: ArrayList with .contains(), but per-input column offsets (small)

No data-proportional linear scans inside loops found.