russell@unturf.com 5b5355cb07 infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN

consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet

6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza

2026-03-29 19:54:13 -04:00

705 B

Raw Permalink Blame History

nifi — CWE-407 Scan Result: CLEAN

Scanned 2026-03-29.

Findings

StandardControllerServiceReference.findRecursiveReferences uses HashSet<ControllerServiceNode> as the visited guard — O(1) lookup. All contains() calls on missingComponentIds, versionedClientIds, etc. operate on Set<String> (HashSet-backed) or List<String> with small bounded sizes (reporting tasks, registry clients — typically < 50).

AbstractPolicyBasedAuthorizer calls policy.getUsers().contains(...) but getUsers() returns a Set<String> per policy (confirmed by interface contract).

No graph traversal with ArrayList visited sets found.

Verdict: CLEAN — no CWE-407 defects warranting a patch.

705 B Raw Permalink Blame History

nifi — CWE-407 Scan Result: CLEAN

Findings

705 B

Raw Permalink Blame History