25 lines
1.2 KiB
Markdown
25 lines
1.2 KiB
Markdown
# UNDF: UNDF-2026-000000358
|
|
## Buck2 — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned: `app/buck2_build_api/src/`, `app/buck2_query/src/`, `app/buck2_query_impls/src/`,
|
|
`app/buck2_node/src/` (depth=1 clone, 2026-03-27)
|
|
|
|
### Patterns checked
|
|
|
|
| Location | Type | Verdict |
|
|
|----------|------|---------|
|
|
| `query/traversal.rs` L102/109/119 | `visited.contains()` | CLEAN — `std::collections::HashSet` with `StarlarkHasherBuilder` |
|
|
| `query/graph/visited.rs` | `Visited.contains()` | CLEAN — custom hash-set wrapper |
|
|
| `transitive_set_iterator.rs` | `self.seen.contains()` | CLEAN — `HashSet<ValueIdentity, BuckHasherBuilder>` |
|
|
| `build_api/state.rs` | `executed_actions.contains()` | CLEAN — `buck2_hash::BuckHashSet<ActionKey>` |
|
|
| `action_executor.rs` | `result_output_paths.contains()` | CLEAN — `HashSet<&BuildArtifactPath>` |
|
|
| `query/graph/dfs.rs` | `visited.contains()` | CLEAN — custom O(1) visited tracker |
|
|
|
|
### Key finding
|
|
|
|
Buck2's Rust codebase consistently uses `HashSet` (or `BuckHashSet` / `ReferenceOpenHashSet`
|
|
wrappers) for all visited-node tracking in build-graph traversal. No `Vec::contains()`
|
|
patterns were found in hot graph-traversal paths. Buck2 is architecturally clean with
|
|
respect to CWE-407.
|
|
|
|
No CWE-407 defects found.
|