russell@unturf.com
52a8d535a2
dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238) cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237) Struts, RabbitMQ, Camel: CLEAN
1.3 KiB
Apache Camel — CWE-407 Scan Result: CLEAN (beyond camel-0001)
Scan Date: 2026-03-29
Scope
Searched for route dependency traversal, @DependsOn-style annotation handling, and
recursive route startup ordering without visited sets. The pre-existing camel-0001 defect
(route startup ArrayList O(R²)) is already documented.
Findings
InternalRouteStartupManager
Route startup ordering uses TreeMap and LinkedHashMap for ordering — no recursive
traversal of a route dependency graph. Routes are sorted by startupOrder integer value
via Comparator, not by graph traversal.
AbstractCamelContextFactoryBean.getDependsOn
getDependsOn() is an abstract method returning a String — just a label for Spring
@DependsOn ordering. No Camel-internal graph traversal is performed; Spring's own
dependency resolution handles this.
Route dependency shutdown (DefaultShutdownStrategy)
Uses reverse startupOrder sorting — no recursive graph traversal.
TypeUtils / annotation processors
Camel does not use annotation processors for meta-annotation hierarchies in the manner
Dubbo does. Camel's @RoutingSlip, @RecipientList etc. are resolved at runtime on
flat lists.
Conclusion
CLEAN (beyond pre-existing camel-0001). No additional CWE-407 defects found in Apache Camel route dependency or startup ordering code.