java-topology/defects/artemis/patch/artemis-CLEAN.md

UNDF: UNDF-2026-000000350

ActiveMQ Artemis CWE-407 Scan — CLEAN (beyond artemis-0001)

Date: 2026-03-28 Repo: https://github.com/apache/activemq-artemis Scan scope: artemis-server/src/main/java/org/apache/activemq/artemis/core/ — postoffice, server/impl, paging, persistence, security, transaction, replication, cluster, filter, group; plus artemis-protocols/ (AMQP, OpenWire, STOMP).

Findings

No new confirmed CWE-407 defects found beyond existing artemis-0001.

Candidates examined

File	Location	Pattern	Verdict
BindingsImpl.java	routeFromCluster	idsToAckList.contains(bindingID) in byte-buffer loop	PATCHED (artemis-0001)
RoutingContextImpl.java	RouteContextList.ackedQueues	ackedQueues.contains(queue) (ArrayList) called from processRouteToDurableQueues	CLEAN — ackedQueues is populated via addQueueWithAck which is called once per QueueImpl.routeWithAck; list remains ≤1 entry per address per routing context (durable queue ArrayList is sized (1)). Not an outer loop over a growing list.
RemoteQueueBindingImpl.java	route()	getDurableQueues().contains(storeAndForwardQueue)	CLEAN — durableQueue is ArrayList(1); O(1) scan for a list bounded to 1 element per address.
ClusterConnectionImpl.java	nodeUP()	allowableConnections.contains(...)	CLEAN — allowableConnections is HashSet; O(1).
ColocatedHAManager.java	updateAcceptorsAndConnectors	remoteConnectors.contains(entry.getValue().getName()) in connector loop	CLEAN — admin/startup path only; connector counts are bounded (single-digit).
MBeanInfoHelper.java	getMBeanAttributesInfo	alreadyAdded.contains(name) in nested loop over methods	CLEAN — results are cached in attributesInfoCache; called once per MBean interface class at registration time, not per-message.
SecurityStoreImpl.java	checkAuthorizationCache	act.contains(dest)	CLEAN — act is ConcurrentHashSet; O(1).
QueueImpl.java	transferTo	targetDuplicateCache.contains(duplicateBytes)	CLEAN — DuplicateIDCache uses ConcurrentHashMap; O(1).
PageCursorProviderImpl.java	cleanupMiddleStream	depagedPagesSet.contains(pageID)	CLEAN — depagedPagesSet is LongHashSet; O(1).
AMQPMessage.java	isAccepted	rejectedConsumers.contains(consumer)	CLEAN — rejectedConsumers is HashSet; O(1).
AMQPFederationAddressPolicyManager.java	afterQueueAdded	divert.getValue().contains(queueBinding)	CLEAN — value is Set<QueueBinding>; O(1).
AMQConsumer.java	isRolledBack	rollbackedMessageRefs.contains(ref)	CLEAN — rollbackedMessageRefs is Set; O(1).
ArtemisRbacInvocationHandler.java	invoke	mBeanServerCheckedMethods.contains(...)	CLEAN — List.of(...) with 7 static entries; effectively O(1).
ResourceManagerImpl.java	getHeuristicCommittedTransactions	List<Xid> returned, then .contains() called by ServerSessionImpl	CLEAN — heuristic completions list is always tiny (admin-path, zero in normal operation).

Summary

All ArrayList.contains() / List.contains() patterns found in the hot message routing paths use sets, maps, bounded lists, or cached structures. The single confirmed defect (artemis-0001, routeFromCluster idsToAckList) has been patched. No further CWE-407 defects found in the Artemis codebase within scan scope.