russell@unturf.com
3bfe10d197
traefik-0001: CheckRecursion slices.Contains on growing stack O(D²) → O(D) with parallel map
nats-server-0001: checkConsumerCfg subject filter overlap double-loop O(S²) → O(S²/2)
grafana: CLEAN (gonum topo sort, map visited sets throughout)
consul: CLEAN (discoverychain map[string]struct{} visited)
containerd: CLEAN (walkBlobVariantsOnly map[digest]struct{})
buildkit: CLEAN (addItemToStorage map[*item] visited)
helm: CLEAN (resolver single-pass, dep list O(D) display-only)
cayley: CLEAN (Recursive.Next map[interface{}]seenAt)
21 lines
900 B
Markdown
21 lines
900 B
Markdown
# consul — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned: 2026-03-29
|
|
|
|
## Scope
|
|
|
|
- `agent/consul/discoverychain/` — service discovery chain compilation: uses
|
|
`map[string]struct{}` for visited sets and a proper `stringStack` (slice with Push/Pop).
|
|
No O(N²) membership checks.
|
|
- `agent/structs/` — config entry validation: uses `map[string]bool` / `map[string]struct{}`
|
|
for seen-address dedup.
|
|
- `agent/xds/` — Envoy cluster/listener building: uses `map[string]struct{}` for dedup.
|
|
- `internal/go-sso/` — `StrListContains` usage: only called on small, bounded slices (3-element
|
|
localhost list, short allowed-URI lists). Not inside a loop.
|
|
- `lib/stringslice/Contains` — all call sites checked; none inside an outer loop over the same
|
|
or related collection.
|
|
|
|
## Verdict
|
|
|
|
No CWE-407 defects found. Consul's service graph and discovery chain use proper hash-set
|
|
visited structures throughout.
|