engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/pinot/patch/CLEAN.md
russell@unturf.com cdf127dd05 java-frameworks: spring/vertx-core/artemis/netty/guice/thrift/grpc/protobuf/hibernate CWE-407 scan; tinkerpop/trino/kotlin/scala3/nifi/druid/graphhopper/janusgraph defects+CLEANs 
Defects found:
- spring-0001: BeanFactoryUtils.mergeNamesWithParent ArrayList.contains O(P×R) MEDIUM
- spring-0002: DefaultListableBeanFactory.getBeanNamesForAnnotation ArrayList.contains O(B×M) MEDIUM
- spring-0003: AnnotationTypeMapping.processAliases ArrayList.contains O(A²×D×L) MEDIUM
- vertx-core-0001: HAManager.nodeLeft nodes List.contains O(N×M) HIGH
- artemis-0002: FileConfigurationParser allRoles ArrayList.contains O(N×R) MEDIUM
- tinkerpop-0001: MutablePath.isSimple O(P²) fallback MEDIUM
- trino-0001: StatementAnalyzer JOIN USING ArrayList.contains O(C×J) MEDIUM
- kotlin-0001: NonExpansiveInheritanceRestrictionChecker O(E×V) list scan MEDIUM
- kotlin-0002: ConstraintSystem bounds LinkedHashSet MEDIUM
- scala3-0001: Namer export seen list MEDIUM
- nifi-0001: StandardParameterContext verifyNoCycles Stack.contains O(D²) MEDIUM
- box2d-0001: BroadPhase index map MEDIUM
- doris-0002: PlanNode conjuncts LinkedHashSet MEDIUM
- dry-0001/0002: DRY list/hashset patches

CLEANs: netty, guice, thrift, grpc (C-only repo), protobuf, hibernate-orm,
        druid, graphhopper, janusgraph, kylin, pinot, victoria-metrics
2026-03-29 19:56:02 -04:00

438 B
Raw Permalink Blame History

Apache Pinot — CWE-407 Scan Result: CLEAN

Scanned 2026-03-29. No new O(N²) list membership defects found.

Verified:

  • SpecialOperations.isFinite: uses HashSet<State> for path and visited — O(1)
  • DispatchablePlanVisitor._visited: uses Set.add() for dedup — O(1)
  • GroupedStages: uses SortedSet<MailboxSendNode> (TreeSet) — O(log N)
  • PinotInstanceRestletResource.visitedInstances: is HashSet<String> — O(1)