engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/hive/patch/CLEAN.md

1.6 KiB
Raw Permalink Blame History

Apache Hive — CWE-407 Scan Result: CLEAN

Date: 2026-03-30 Scanner: agent blackops Scope: ql/src/java/org/apache/hadoop/hive/ql/ (optimizer, parse, exec, metadata, plan) standalone-metastore/metastore-server/

Summary

Apache Hive is clean of CWE-407 algorithmic complexity defects. The codebase consistently uses HashSet for visited tracking, membership tests, and dedup operations throughout the query optimizer, parser, compiler, and metastore.

Key observations

  • OperatorGraph.Cluster.members: HashSet<Operator>
  • TezCompiler.unionOps: HashSet<Operator>
  • TezCompiler.connect() (Tarjan SCC): uses nodes Set for stack membership
  • ColumnPrunerProcFactory: HashSet for colNames membership
  • PipelineTranslation.viewTransforms: HashSet
  • SharedCache.*DeletedDuringPrewarm: HashSet
  • SessionHiveMetaStoreClient.partitionVals: HashSet<List> for partition dedup
  • Hive.createdDeltaDirs: HashSet for ACID delta dir dedup
  • GreedyPipelineFuser: acknowledged O(N²) in sibling grouping but this is inherent compatibility checking

Minor findings (no defect):

  • SemanticAnalyzer.leftAliases/rightAliases: ArrayList with .contains(), but N is join alias count (2-3)
  • WindowingSpec.fillInWindowSpec.visited: ArrayList with .contains(), but N is window spec chain depth (2-3)
  • QueryPlanTreeTransformation.childrenOfDemux: List with .contains(), but N is demux children (2-3)
  • HiveRelDecorrelator.newLocalOutputs: ArrayList with .contains(), but per-input column offsets (small)

No data-proportional linear scans inside loops found.