1.3 KiB
1.3 KiB
ZooKeeper CWE-407 Scan Result: CLEAN (beyond zookeeper-0001)
Scan Date
2026-03-30
Scope
zookeeper-server/src/main/java/org/apache/zookeeper/
Findings
No new CWE-407 defects found beyond the pre-existing zookeeper-0001.
Key structures verified
| Structure | Location | Type | Status |
|---|---|---|---|
forwardingFollowers |
Leader.java:196 |
HashSet<LearnerHandler> |
CLEAN |
cnxns |
ServerCnxnFactory.java:208 |
ConcurrentHashMap-backed Set |
CLEAN |
retainedTxnLogs |
PurgeTxnLog.java:112 |
HashSet<File> |
CLEAN |
aclKeyMap |
ReferenceCountedACLCache.java |
HashMap<List<ACL>, Long> |
CLEAN |
connectingFollowers |
Leader.java |
passed to containsQuorum() via Set |
CLEAN |
enforceAuthSchemes |
AuthenticationHelper.java:45 |
ArrayList<String> — but N≤5 config list, not hot |
LOW (N too small) |
| Watch managers | WatchManager*.java |
HashSet / BitSet |
CLEAN |
Note on enforceAuthSchemes
enforceAuthSchemes at AuthenticationHelper.java:45 is an ArrayList<String> with .contains()
called in isCnxnAuthenticated(). However, this list contains at most 2–3 scheme strings
configured at startup. The O(N) cost per auth check is negligible (N is bounded and tiny). This
does not rise to the level of a CWE-407 defect.