java-topology/defects/spark/patch/spark-0001-analyzer-seenwindowaggregates-linkedhashset.patch

13 lines
1 KiB
Diff

# UNDF: UNDF-2026-000000290
diff --git a/sql/catalyst/src/main/scala/org/apache/spark/sql/catalyst/analysis/Analyzer.scala b/sql/catalyst/src/main/scala/org/apache/spark/sql/catalyst/analysis/Analyzer.scala
--- a/sql/catalyst/src/main/scala/org/apache/spark/sql/catalyst/analysis/Analyzer.scala
+++ b/sql/catalyst/src/main/scala/org/apache/spark/sql/catalyst/analysis/Analyzer.scala
@@ -3283,8 +3283,9 @@ class Analyzer(override val catalogManager: CatalogManager) extends RuleExecuto
// Now, we extract regular expressions from expressionsWithWindowFunctions
// by using extractExpr.
- val seenWindowAggregates = new ArrayBuffer[AggregateExpression]
+ // CWE-407 fix: LinkedHashSet for O(1) contains() instead of O(W) ArrayBuffer scan.
+ // Preserves insertion order for deterministic output; equality via AggregateExpression.equals.
+ val seenWindowAggregates = new mutable.LinkedHashSet[AggregateExpression]
val newExpressionsWithWindowFunctions = expressionsWithWindowFunctions.map {
_.transform {