russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
30 lines
1.3 KiB
ReStructuredText
30 lines
1.3 KiB
ReStructuredText
Apache Ant — CWE-407 Analysis
|
|
==============================
|
|
|
|
**Status: CLEAN — 0 confirmed defects**
|
|
|
|
Apache Ant's target dependency executor and class dependency analyzer were scanned.
|
|
The scanner returned 19 candidates; all are false positives on ``HashSet``-backed
|
|
collections.
|
|
|
|
Key findings:
|
|
|
|
- ``Project.java:1389`` — ``succeededTargets.contains(dependencyName)`` inside
|
|
``executeSortedTargets`` target dependency execution loop.
|
|
``succeededTargets`` is declared ``new HashSet<>()`` — O(1). FALSE POSITIVE.
|
|
|
|
- ``bcel/AncestorAnalyzer.java:99,106`` — ``!dependencies.contains(interfaceName/superClass)``
|
|
inside BCEL class hierarchy traversal loop. ``dependencies`` is declared
|
|
``new HashSet<>()`` — O(1). FALSE POSITIVE.
|
|
|
|
- ``bcel/FullAnalyzer.java:108`` — same pattern, same ``HashSet`` container. FALSE POSITIVE.
|
|
|
|
- ``DependScanner.java:131`` — ``parentSet.contains(fName)``. ``parentSet`` is built via
|
|
``.collect(Collectors.toSet())`` — a ``HashSet``. FALSE POSITIVE.
|
|
|
|
Despite being a ~2002-era Java codebase with high prior probability of ArrayList
|
|
patterns, Ant's dependency tracking code uses modern ``HashSet`` containers throughout.
|
|
The build system correctly avoids the CWE-407 pattern.
|
|
|
|
* Scanner: ``tools/scans/ant.sh``
|
|
* Scan result: ``tools/scan-results/ant.txt`` — 19 candidates, all false positives
|