engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/consul/patch/CLEAN.md
russell@unturf.com 3bfe10d197 go-cluster: traefik-0001/nats-server-0001 CWE-407; grafana/consul/containerd/buildkit/helm/cayley CLEAN 
traefik-0001: CheckRecursion slices.Contains on growing stack O(D²) → O(D) with parallel map
nats-server-0001: checkConsumerCfg subject filter overlap double-loop O(S²) → O(S²/2)
grafana: CLEAN (gonum topo sort, map visited sets throughout)
consul: CLEAN (discoverychain map[string]struct{} visited)
containerd: CLEAN (walkBlobVariantsOnly map[digest]struct{})
buildkit: CLEAN (addItemToStorage map[*item] visited)
helm: CLEAN (resolver single-pass, dep list O(D) display-only)
cayley: CLEAN (Recursive.Next map[interface{}]seenAt)
2026-03-29 19:47:27 -04:00

900 B
Raw Permalink Blame History

consul — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-29

Scope

  • agent/consul/discoverychain/ — service discovery chain compilation: uses map[string]struct{} for visited sets and a proper stringStack (slice with Push/Pop). No O(N²) membership checks.
  • agent/structs/ — config entry validation: uses map[string]bool / map[string]struct{} for seen-address dedup.
  • agent/xds/ — Envoy cluster/listener building: uses map[string]struct{} for dedup.
  • internal/go-sso/ — StrListContains usage: only called on small, bounded slices (3-element localhost list, short allowed-URI lists). Not inside a loop.
  • lib/stringslice/Contains — all call sites checked; none inside an outer loop over the same or related collection.

Verdict

No CWE-407 defects found. Consul's service graph and discovery chain use proper hash-set visited structures throughout.