engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/pulsar/patch/pulsar-deeper-CLEAN.md

1.4 KiB
Raw Permalink Blame History

UNDF: UNDF-2026-000000505

pulsar deeper scan — CWE-407 triage

Scan date: 2026-03-27

Areas scanned

Path Result
pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ CLEAN — consumerList.contains guarded by consumerSet (HashSet), membership check deferred to Set
pulsar-broker/src/main/java/org/apache/pulsar/broker/resourcegroup/ResourceUsageTopicTransportManager.java CLEAN — tenantList.contains and nsList.contains are one-shot checks at startup, not in a loop
pulsar-broker/src/main/java/org/apache/pulsar/broker/loadbalance/ CLEAN — no ArrayList.contains in loops found
pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/ CLEAN
pulsar-broker/src/main/java/org/apache/pulsar/broker/namespace/ CLEAN
pulsar-client/src/main/java/org/apache/pulsar/client/impl/customroute/PartialRoundRobinMessageRouterImpl.java pulsar-0005 — CopyOnWriteArrayList.contains in O(N) stream filter
pulsar-client/src/main/java/ (rest) CLEAN — sharedResources.contains is on a small enum-backed list
managed-ledger/src/main/java/ CLEAN — String.contains (substring match), not collection membership
pulsar-common/src/main/java/ CLEAN

Defect found

  • pulsar-0005: PartialRoundRobinMessageRouterImpl.java CopyOnWriteArrayList.contains O(N×L) — patched, 3/3 PASS, 18×–71× measured