russell@unturf.com
52a8d535a2
dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238) cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237) Struts, RabbitMQ, Camel: CLEAN
32 lines
1.3 KiB
Markdown
32 lines
1.3 KiB
Markdown
# Apache Camel — CWE-407 Scan Result: CLEAN (beyond camel-0001)
|
|
|
|
## Scan Date: 2026-03-29
|
|
|
|
## Scope
|
|
Searched for route dependency traversal, `@DependsOn`-style annotation handling, and
|
|
recursive route startup ordering without visited sets. The pre-existing `camel-0001` defect
|
|
(route startup `ArrayList` O(R²)) is already documented.
|
|
|
|
## Findings
|
|
|
|
### InternalRouteStartupManager
|
|
Route startup ordering uses `TreeMap` and `LinkedHashMap` for ordering — no recursive
|
|
traversal of a route dependency graph. Routes are sorted by `startupOrder` integer value
|
|
via `Comparator`, not by graph traversal.
|
|
|
|
### AbstractCamelContextFactoryBean.getDependsOn
|
|
`getDependsOn()` is an abstract method returning a `String` — just a label for Spring
|
|
`@DependsOn` ordering. No Camel-internal graph traversal is performed; Spring's own
|
|
dependency resolution handles this.
|
|
|
|
### Route dependency shutdown (DefaultShutdownStrategy)
|
|
Uses reverse `startupOrder` sorting — no recursive graph traversal.
|
|
|
|
### TypeUtils / annotation processors
|
|
Camel does not use annotation processors for meta-annotation hierarchies in the manner
|
|
Dubbo does. Camel's `@RoutingSlip`, `@RecipientList` etc. are resolved at runtime on
|
|
flat lists.
|
|
|
|
## Conclusion
|
|
CLEAN (beyond pre-existing camel-0001). No additional CWE-407 defects found in Apache Camel
|
|
route dependency or startup ordering code.
|