russell@unturf.com
27382ae791
Netdata: well-engineered with Judy arrays, dictionaries, hash tables throughout. No CWE-407 defects found. Telegraf: dedup processor Apply() calls m.GetField(f.Key) O(F) inside field comparison loop → O(F²). Fix: build field map for O(1) lookup. 125x overhead at F=500.
32 lines
1.4 KiB
Markdown
32 lines
1.4 KiB
Markdown
# Netdata — CWE-407 Scan Result: CLEAN
|
|
|
|
**Date:** 2026-03-30
|
|
**Scanner:** agent blackops
|
|
**Target:** https://github.com/netdata/netdata (depth=1)
|
|
**Language:** C + Go
|
|
|
|
## Scan Coverage
|
|
|
|
- `src/health/` — alarm templates, silencers, prototypes
|
|
- `src/streaming/` — stream path, replication, capabilities
|
|
- `src/database/` — rrdlabels, rrdhost, rrdset, rrddim, contexts, query_target, engine
|
|
- `src/libnetdata/` — adaptive_resortable_list, dictionary, facets, string dedup, user-auth
|
|
- `src/web/` — websocket JSONRPC, MCP, API v1
|
|
- `src/exporting/` — Prometheus exporter server list
|
|
- `src/registry/` — person/machine URL tracking
|
|
- `src/collectors/` — ebpf, log2journal
|
|
- `src/go/plugin/` — job manager, SNMP profile loader, multipath, weblog collector
|
|
|
|
## Findings
|
|
|
|
No CWE-407 defects found. Netdata's core data structures are well-engineered:
|
|
|
|
- **Judy arrays** (JudyL, JudyHS) for labels, metrics registry
|
|
- **Dictionary** (hash-table based) for rrdhost, rrdset, rrddim, contexts
|
|
- **SIMPLE_HASHTABLE** for facets value indexing
|
|
- **Bitmask dedup** for HTTP access flags, RRDR options, stream capabilities
|
|
- **Adaptive Resortable List** (self-sorting linked list) for /proc parsing — amortized fast path
|
|
- **STRING dedup** via global hash table for string interning
|
|
|
|
The few linked-list scans found (registry person URLs, Prometheus server list, health silencer list)
|
|
are per-request lookups, not inside nested loops. No O(N²) membership patterns detected.
|