russell@unturf.com
3bfe10d197
traefik-0001: CheckRecursion slices.Contains on growing stack O(D²) → O(D) with parallel map
nats-server-0001: checkConsumerCfg subject filter overlap double-loop O(S²) → O(S²/2)
grafana: CLEAN (gonum topo sort, map visited sets throughout)
consul: CLEAN (discoverychain map[string]struct{} visited)
containerd: CLEAN (walkBlobVariantsOnly map[digest]struct{})
buildkit: CLEAN (addItemToStorage map[*item] visited)
helm: CLEAN (resolver single-pass, dep list O(D) display-only)
cayley: CLEAN (Recursive.Next map[interface{}]seenAt)
18 lines
855 B
Markdown
18 lines
855 B
Markdown
# helm — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned: 2026-03-29
|
|
|
|
## Scope
|
|
|
|
- `internal/resolver/resolver.go` — dependency resolution: iterates once over `reqs` slice,
|
|
does O(1) map lookups into `repoIndex.Entries`. No nested loops over deps.
|
|
- `pkg/action/dependency.go` — `dependencyStatus`: inner `for _, item := range parent.Dependencies()`
|
|
is a bounded per-row search, not called in a hot path (only for `helm dep list` display).
|
|
- `internal/chart/v3/dependency.go` — data struct only, no algorithms.
|
|
- All `slices.Contains` call sites: on small bounded lists (schemes, protocols, extensions,
|
|
hook policies). None inside per-chart or per-dep loops.
|
|
|
|
## Verdict
|
|
|
|
No CWE-407 defects found. The `dependencyStatus` O(D) scan per row is only used in the
|
|
human-readable `helm dep list` command output path, not in the hot dependency-resolution loop.
|