russell@unturf.com
5b5355cb07
consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet
6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza
16 lines
693 B
Markdown
16 lines
693 B
Markdown
# containerd — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned 2026-03-29.
|
|
|
|
## Findings
|
|
|
|
`slices.Contains` is used in several paths (mount options, capabilities, snapshotter
|
|
capabilities, platform lists) but all target lists are small and bounded (typically
|
|
< 10 elements): mount option flags, GID lists, network namespace types.
|
|
|
|
No O(N²) patterns in hot paths (content ingestion, snapshot chain management,
|
|
layer unpacking). The `cacheResultStorage.HasLink()` in `remotecache/v1/cachestorage.go`
|
|
calls `slices.Contains(it.links[l], target)` but `it.links[l]` is a deduplicated
|
|
list of cache targets per link key — bounded in practice.
|
|
|
|
**Verdict: CLEAN** — no CWE-407 defects warranting a patch.
|