russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
32 lines
1,003 B
ReStructuredText
32 lines
1,003 B
ReStructuredText
Gradle — CWE-407 Analysis
|
|
==========================
|
|
|
|
.. contents:: :local:
|
|
|
|
Overview
|
|
--------
|
|
|
|
Gradle is a build automation tool used widely in Java, Kotlin, and Android projects. Its
|
|
execution plan and dependency resolution infrastructure uses ``HashSet`` and ``HashMultimap``
|
|
throughout.
|
|
|
|
Status: CLEAN
|
|
-------------
|
|
|
|
Gradle is confirmed to use correct O(1) data structures for graph traversal. No CWE-407 defect
|
|
sites were found.
|
|
|
|
Key implementations:
|
|
|
|
- ``ExecutionPlan``: ``HashSet<Node>`` for visited node tracking
|
|
- ``DefaultConfiguration``: ``HashMultimap`` for dependency edges
|
|
- Dependency resolution: ``LinkedHashMap`` / ``LinkedHashSet`` for ordered set operations
|
|
|
|
Gradle serves as a reference implementation of correct practice in the Java build-tool
|
|
ecosystem. Its correctness stands in contrast to Maven, which uses ``ArrayList`` with linear
|
|
scan in its project graph.
|
|
|
|
References
|
|
----------
|
|
|
|
* Scanner output: ``tools/scan-cwe407.sh`` on ``/home/fox/git/gradle`` — no defect sites
|