russell@unturf.com
5b5355cb07
consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet
6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza
14 lines
543 B
Markdown
14 lines
543 B
Markdown
# buildkit — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned 2026-03-29.
|
|
|
|
## Findings
|
|
|
|
No custom slice-contains helpers. `slices.Contains` and `slices.ContainsFunc` used
|
|
in bounded contexts (compression type checks, platform filtering, annotation
|
|
repository dedup per descriptor — the `existingRepos` list is rebuilt from
|
|
comma-separated annotations per descriptor, not accumulated across descriptors).
|
|
|
|
Graph traversal in `remotecache/v1/parse.go` uses a `map[int]struct{}` visited set.
|
|
|
|
**Verdict: CLEAN** — no CWE-407 defects warranting a patch.
|