russell@unturf.com
5b5355cb07
consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet
6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza
15 lines
595 B
Markdown
15 lines
595 B
Markdown
# samza — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned 2026-03-29.
|
|
|
|
## Findings
|
|
|
|
`JobGraph.findReachable()` and `topologicalSort()` use `HashSet<JobNode>` for visited
|
|
tracking. `JobNode.findReachableOperators()` uses `Set<OperatorSpec>` (HashSet).
|
|
`PollingScanDiskSpaceMonitor.getSpaceUsed()` uses `Set<Path>` (HashSet).
|
|
`GroupByContainerIds.group()` uses `Set<TaskName>` (HashSet) for `assignedTasks`.
|
|
`IntermediateStreamManager` uses `Set<StreamSet>` (HashSet) for `processedStreamSets`.
|
|
|
|
No ArrayList-based visited/seen patterns found.
|
|
|
|
**Verdict: CLEAN** — no CWE-407 defects warranting a patch.
|