engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/traefik/patch/traefik-diamond-recursion-CLEAN.md
russell@unturf.com 7af6b9c89f threejs-0007: Node.traverse() diamond recursion O(2^D); CLEAN for webpack/valhalla/traefik/wasmer/wasmtime; count 621->622 
UNDF-2026-000000468: three.js src/nodes/core/Node.js:351 traverse() recurses
without a visited set; on shared-node (diamond) TSL shader graphs yields 2^D
callback invocations. D=10 gives 4093× overhead. Fix: add optional visited Set
parameter, default new Set() at root call.

Unit test: 10/10 PASS (ThreeJSNodeTraverseTest.java)

CLEAN markers written for: webpack (visitedModules WeakSet throughout),
valhalla (Dijkstra+BFS, no recursive DAG traversal), traefik (traverse() has
proper visited map), wasmer (petgraph+BTreeMap), wasmtime (SCC algorithms).
2026-03-29 17:07:25 -04:00

864 B
Raw Permalink Blame History

Diamond Recursion Scan (traefik) — CLEAN

Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

Files examined

  • pkg/server/router/router.go — Manager.traverse() — correct implementation: accepts visited map[string]bool and currentPath map[string]bool; returns early on visited[routerName]. CLEAN.
  • pkg/server/recursion/recursion.go — CheckRecursion() uses context-based tracking. CLEAN.
  • pkg/server/middleware/tcp/middlewares.go — checkRecursion() uses context. CLEAN.

Verdict: CLEAN — no diamond recursion CWE-407 found in traefik

The traverse() function in pkg/server/router/router.go explicitly maintains a visited map across the recursion. Prior defects (traefik-0001/0002/0003) are O(N) linear slice scans, already documented.