30 lines
1.3 KiB
Markdown
30 lines
1.3 KiB
Markdown
# ZooKeeper CWE-407 Scan Result: CLEAN (beyond zookeeper-0001)
|
||
|
||
## Scan Date
|
||
2026-03-30
|
||
|
||
## Scope
|
||
`zookeeper-server/src/main/java/org/apache/zookeeper/`
|
||
|
||
## Findings
|
||
|
||
No new CWE-407 defects found beyond the pre-existing zookeeper-0001.
|
||
|
||
### Key structures verified
|
||
|
||
| Structure | Location | Type | Status |
|
||
|-----------|----------|------|--------|
|
||
| `forwardingFollowers` | `Leader.java:196` | `HashSet<LearnerHandler>` | CLEAN |
|
||
| `cnxns` | `ServerCnxnFactory.java:208` | `ConcurrentHashMap`-backed Set | CLEAN |
|
||
| `retainedTxnLogs` | `PurgeTxnLog.java:112` | `HashSet<File>` | CLEAN |
|
||
| `aclKeyMap` | `ReferenceCountedACLCache.java` | `HashMap<List<ACL>, Long>` | CLEAN |
|
||
| `connectingFollowers` | `Leader.java` | passed to `containsQuorum()` via Set | CLEAN |
|
||
| `enforceAuthSchemes` | `AuthenticationHelper.java:45` | `ArrayList<String>` — but N≤5 config list, not hot | LOW (N too small) |
|
||
| Watch managers | `WatchManager*.java` | `HashSet` / `BitSet` | CLEAN |
|
||
|
||
### Note on `enforceAuthSchemes`
|
||
|
||
`enforceAuthSchemes` at `AuthenticationHelper.java:45` is an `ArrayList<String>` with `.contains()`
|
||
called in `isCnxnAuthenticated()`. However, this list contains at most 2–3 scheme strings
|
||
configured at startup. The O(N) cost per auth check is negligible (N is bounded and tiny). This
|
||
does not rise to the level of a CWE-407 defect.
|