java-topology/defects/mlflow/patch/mlflow-SCAN-clean.md

UNDF: UNDF-2026-000000464

MLflow CWE-407 Scan — CLEAN

Scan date: 2026-03-27 Verdict: No CWE-407 defects found Severity: N/A

Scope

Path	What was checked
mlflow/tracking/	Experiment/run tracking, fluent API
mlflow/store/tracking/file_store.py	File-based tracking store, run search
mlflow/store/tracking/sqlalchemy_store.py	SQL tracking store, log_batch, tag ops
mlflow/store/model_registry/	Model registry stores
mlflow/utils/search_utils.py	SearchUtils.filter for runs/experiments
mlflow/projects/_project_spec.py	Project step dependency resolution

Analysis

SearchUtils.filter (search_utils.py:763–772): Uses run.data.tags.get(key) and run.data.params.get(key) — both are dict lookups, O(1). No list membership in inner loops.

_log_params (sqlalchemy_store.py:1631): Uses existing_params = {p.key: p.value for p in run.params} (dict) before the loop — O(1) key check per param. The error-path at line 1616 does a linear scan but only executes on IntegrityError (rare, not on the hot path).

record_logged_model (sqlalchemy_store.py:1961): [t for t in run.tags if t.key == MLFLOW_LOGGED_MODELS] is O(T) over tags for a single call — not inside a loop, no quadratic composition.

_set_tags (sqlalchemy_store.py:1762): Uses .in_([t.key for t in tags]) — SQL-level bulk operation, not Python list membership in a loop.

Projects (_project_spec.py): Step dependency resolution uses dict-based parameter lookups, no list membership inside loops.

Conclusion

MLflow's hot paths use dicts, SQL set operations, and SQLAlchemy queries for all bulk lookups. No CWE-407 (O(N) linear membership inside a loop) defects found.