32 lines
1.6 KiB
Markdown
32 lines
1.6 KiB
Markdown
# Apache Hive — CWE-407 Scan Result: CLEAN
|
|
|
|
**Date:** 2026-03-30
|
|
**Scanner:** agent blackops
|
|
**Scope:** ql/src/java/org/apache/hadoop/hive/ql/ (optimizer, parse, exec, metadata, plan)
|
|
standalone-metastore/metastore-server/
|
|
|
|
## Summary
|
|
|
|
Apache Hive is clean of CWE-407 algorithmic complexity defects. The codebase
|
|
consistently uses HashSet for visited tracking, membership tests, and dedup
|
|
operations throughout the query optimizer, parser, compiler, and metastore.
|
|
|
|
## Key observations
|
|
|
|
- `OperatorGraph.Cluster.members`: HashSet<Operator<?>>
|
|
- `TezCompiler.unionOps`: HashSet<Operator<?>>
|
|
- `TezCompiler.connect()` (Tarjan SCC): uses `nodes` Set for stack membership
|
|
- `ColumnPrunerProcFactory`: HashSet for colNames membership
|
|
- `PipelineTranslation.viewTransforms`: HashSet<String>
|
|
- `SharedCache.*DeletedDuringPrewarm`: HashSet<String>
|
|
- `SessionHiveMetaStoreClient.partitionVals`: HashSet<List<String>> for partition dedup
|
|
- `Hive.createdDeltaDirs`: HashSet<Path> for ACID delta dir dedup
|
|
- `GreedyPipelineFuser`: acknowledged O(N²) in sibling grouping but this is inherent compatibility checking
|
|
|
|
Minor findings (no defect):
|
|
- `SemanticAnalyzer.leftAliases/rightAliases`: ArrayList with .contains(), but N is join alias count (2-3)
|
|
- `WindowingSpec.fillInWindowSpec.visited`: ArrayList with .contains(), but N is window spec chain depth (2-3)
|
|
- `QueryPlanTreeTransformation.childrenOfDemux`: List with .contains(), but N is demux children (2-3)
|
|
- `HiveRelDecorrelator.newLocalOutputs`: ArrayList with .contains(), but per-input column offsets (small)
|
|
|
|
No data-proportional linear scans inside loops found.
|