1.2 KiB
1.2 KiB
UNDF: UNDF-2026-000000358
Buck2 — CWE-407 Scan Result: CLEAN
Scanned: app/buck2_build_api/src/, app/buck2_query/src/, app/buck2_query_impls/src/,
app/buck2_node/src/ (depth=1 clone, 2026-03-27)
Patterns checked
| Location | Type | Verdict |
|---|---|---|
query/traversal.rs L102/109/119 |
visited.contains() |
CLEAN — std::collections::HashSet with StarlarkHasherBuilder |
query/graph/visited.rs |
Visited.contains() |
CLEAN — custom hash-set wrapper |
transitive_set_iterator.rs |
self.seen.contains() |
CLEAN — HashSet<ValueIdentity, BuckHasherBuilder> |
build_api/state.rs |
executed_actions.contains() |
CLEAN — buck2_hash::BuckHashSet<ActionKey> |
action_executor.rs |
result_output_paths.contains() |
CLEAN — HashSet<&BuildArtifactPath> |
query/graph/dfs.rs |
visited.contains() |
CLEAN — custom O(1) visited tracker |
Key finding
Buck2's Rust codebase consistently uses HashSet (or BuckHashSet / ReferenceOpenHashSet
wrappers) for all visited-node tracking in build-graph traversal. No Vec::contains()
patterns were found in hot graph-traversal paths. Buck2 is architecturally clean with
respect to CWE-407.
No CWE-407 defects found.