russell@unturf.com
5c94ac750a
Superset: - superset-0001: SecurityManager._get_pvms_from_builtin_role pvm list dedup O(Regex*PVMs*R) HIGH 8x - superset-0002: DashboardDAO.update_native_filters_config filter dedup O(M*U) MEDIUM 40x - superset-0003: import_datasource metric/column dedup O(N^2) list rebuild MEDIUM 68x Metabase: CLEAN — Clojure backend uses sets/maps throughout for membership tests
33 lines
1.3 KiB
Markdown
33 lines
1.3 KiB
Markdown
# Metabase — CWE-407 Scan Result: CLEAN
|
|
|
|
**Date:** 2026-03-30
|
|
**Target:** Metabase (Clojure + TypeScript/JS frontend)
|
|
**Source:** https://github.com/metabase/metabase (depth=1)
|
|
|
|
## Scan Summary
|
|
|
|
Metabase's Clojure backend makes exemplary use of persistent hash sets and maps
|
|
for membership testing throughout. Key observations:
|
|
|
|
- `graph/core.cljc` uses `LinkedHashSet` (.contains is O(1)) for graph traversal
|
|
- Permission checks use `contains?` on maps/sets (O(1))
|
|
- Dashboard/query code uses `(into #{} ...)` before membership tests
|
|
- Chain filter dedup uses `clojure.set` operations
|
|
- Frontend `.includes()` calls are on small UI-bound arrays (parameters, form fields)
|
|
|
|
No linear-scan membership test inside a loop found at scale.
|
|
|
|
## Areas Scanned
|
|
|
|
- `src/metabase/graph/core.cljc` -- graph walking, transitive closure
|
|
- `src/metabase/security/`, `src/metabase/permissions/` -- permission models
|
|
- `src/metabase/dashboards*/` -- dashboard card/parameter dedup
|
|
- `src/metabase/parameters/chain_filter/` -- join deduplication
|
|
- `src/metabase/sync/` -- database sync
|
|
- `src/metabase/query_processor/` -- query processing pipeline
|
|
- `enterprise/backend/src/` -- enterprise features
|
|
- `frontend/src/metabase/dashboard/` -- frontend selectors
|
|
|
|
## Verdict
|
|
|
|
CLEAN -- no CWE-407 defects found.
|