russell@unturf.com
1a1abc2154
Beam: exhaustive scan of sdks/java/core + runners — all membership tests already use proper Set types (HashSet, LinkedHashSet, ImmutableSet, TreeSet). CLEAN. Hive hive-0001: SharedWorkOptimizer.mergeSchema() uses List.contains() in loops for neededColumnIDs/neededColumns/virtualCols dedup. O(D*R) per list. MEDIUM, 3-4x. Hive hive-0002: HiveRelMdSize.averageColumnSizes() uses ImmutableList.contains(i) in column loop during Calcite metadata queries. O(C*L). MEDIUM, 3-5x. Both patched with HashSet wrappers. 2/2 unit tests PASS.
25 lines
1.2 KiB
Markdown
25 lines
1.2 KiB
Markdown
# Apache Beam — CWE-407 Scan Result: CLEAN
|
|
|
|
**Date:** 2026-03-30
|
|
**Target:** Apache Beam (Java SDK + Runners)
|
|
**Scope:** `sdks/java/core/src/main/java/`, `runners/*/src/main/java/`
|
|
|
|
## Summary
|
|
|
|
No CWE-407 (algorithmic complexity via linear membership test in loop) defects found.
|
|
|
|
Apache Beam consistently uses proper data structures for membership testing:
|
|
- `TransformHierarchy.visit()`: `Set<PValue>` and `Set<Node>` for visitedValues/visitedNodes
|
|
- `PortablePipelineJarCreator.copyResourcesFromJar()`: `HashSet<String>` for previousEntryNames
|
|
- `PipelineTranslation`: `HashSet<String>` for viewTransforms
|
|
- `GreedyStageFuser`: `LinkedHashSet` for fusedCollections/materializedPCollections
|
|
- `Networks.reachableNodes()`: `HashSet` for visitedNodes
|
|
- `OutputDeduplicator`: `HashMultimap` for pcollectionProducers
|
|
- `SamzaTimerInternalsFactory`: `TreeSet` for eventTimeBuffer
|
|
- `DisplayData.Builder`: `IdentityHashSet` for visitedComponents
|
|
- `FieldAccessDescriptor.union()`: `LinkedHashSet` for fieldsAccessed
|
|
- `PipelineOptionsFactory`: `ImmutableSet` for IGNORED_METHODS, PIPELINE_OPTIONS_FACTORY_CLASSES
|
|
|
|
## Keywords searched
|
|
|
|
`.contains(`, `.indexOf(`, `ArrayList`, `List<`, `visited`, `seen`, `worklist`
|