russell@unturf.com
7af6b9c89f
UNDF-2026-000000468: three.js src/nodes/core/Node.js:351 traverse() recurses without a visited set; on shared-node (diamond) TSL shader graphs yields 2^D callback invocations. D=10 gives 4093× overhead. Fix: add optional visited Set parameter, default new Set() at root call. Unit test: 10/10 PASS (ThreeJSNodeTraverseTest.java) CLEAN markers written for: webpack (visitedModules WeakSet throughout), valhalla (Dijkstra+BFS, no recursive DAG traversal), traefik (traverse() has proper visited map), wasmer (petgraph+BTreeMap), wasmtime (SCC algorithms).
729 B
729 B
Diamond Recursion Scan (valhalla) — CLEAN
Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
Files examined
src/thor/(routing algorithms: Dijkstra, A*, multimodal) — uses priority queue + visited flag on graph nodes. CLEAN.src/baldr/— graph tile access, no recursive graph traversal. CLEAN.src/mjolnir/linkclassification.cc— prior defect valhalla-0001 (O(F×R) linear scan, MEDIUM) already documented.
Verdict: CLEAN — no diamond recursion CWE-407 found in valhalla
Valhalla's routing engine uses well-structured BFS/Dijkstra with per-node visited state. No recursive DAG traversal without visited set found.