engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/zenoss/CLEAN.md
russell@unturf.com 0de158cd7a monitoring scan: nagioscore 2 defects, zabbix 2 defects, zenoss CLEAN 
nagioscore-0001: add_notification find_notification linked-list O(C²) HIGH 999x
nagioscore-0002: add_object_to_objectlist linked-list dedup O(N²) MEDIUM 1499x
zabbix-0001: process_problem_tags tag dedup O(T²) HIGH 1499x
zabbix-0002: discoverer_queue_lock job ID dedup O(N²) MEDIUM 1499x
zenoss: CLEAN — uses OrderedDict/set/catalog throughout

4/4 PASS, 4 defects across 2 targets
2026-03-30 16:56:56 -04:00

816 B
Raw Permalink Blame History

Zenoss CWE-407 Scan — CLEAN

Scanned: 2026-03-30 Target: zenoss-prodbin (https://github.com/zenoss/zenoss-prodbin) Language: Python

Scan Summary

Zenoss uses Zope catalogs, OrderedDict, dicts, and sets throughout its codebase for data lookups and dedup. Key findings:

  • Event dedup: Uses OrderedDict (O(1) fingerprint lookup) — clean
  • Device/component lookups: Uses catalog queries (indexed) — clean
  • Collection dedup: Uses set for tid tracking — clean
  • Link manager: Uses set subtraction for visited tracking — clean
  • Config cache: Uses model index queries — clean

No CWE-407 defects found with sufficient severity for a hot-path impact. Minor O(N×M) patterns exist (MibModule.deleteMibNodes, ZenPackCmd dependency resolution) but operate on small, user-bounded inputs.