russell@unturf.com
5b5355cb07
consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet
6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza
17 lines
705 B
Markdown
17 lines
705 B
Markdown
# nifi — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned 2026-03-29.
|
|
|
|
## Findings
|
|
|
|
`StandardControllerServiceReference.findRecursiveReferences` uses `HashSet<ControllerServiceNode>`
|
|
as the visited guard — O(1) lookup. All `contains()` calls on `missingComponentIds`,
|
|
`versionedClientIds`, etc. operate on `Set<String>` (HashSet-backed) or `List<String>`
|
|
with small bounded sizes (reporting tasks, registry clients — typically < 50).
|
|
|
|
`AbstractPolicyBasedAuthorizer` calls `policy.getUsers().contains(...)` but `getUsers()`
|
|
returns a `Set<String>` per policy (confirmed by interface contract).
|
|
|
|
No graph traversal with ArrayList visited sets found.
|
|
|
|
**Verdict: CLEAN** — no CWE-407 defects warranting a patch.
|