40 lines
1.7 KiB
Markdown
40 lines
1.7 KiB
Markdown
# UNDF: UNDF-2026-000000464
|
||
# MLflow CWE-407 Scan — CLEAN
|
||
|
||
**Scan date:** 2026-03-27
|
||
**Verdict:** No CWE-407 defects found
|
||
**Severity:** N/A
|
||
|
||
## Scope
|
||
|
||
| Path | What was checked |
|
||
|------|-----------------|
|
||
| `mlflow/tracking/` | Experiment/run tracking, fluent API |
|
||
| `mlflow/store/tracking/file_store.py` | File-based tracking store, run search |
|
||
| `mlflow/store/tracking/sqlalchemy_store.py` | SQL tracking store, log_batch, tag ops |
|
||
| `mlflow/store/model_registry/` | Model registry stores |
|
||
| `mlflow/utils/search_utils.py` | SearchUtils.filter for runs/experiments |
|
||
| `mlflow/projects/_project_spec.py` | Project step dependency resolution |
|
||
|
||
## Analysis
|
||
|
||
**SearchUtils.filter** (`search_utils.py:763–772`): Uses `run.data.tags.get(key)` and
|
||
`run.data.params.get(key)` — both are dict lookups, O(1). No list membership in inner loops.
|
||
|
||
**`_log_params`** (`sqlalchemy_store.py:1631`): Uses `existing_params = {p.key: p.value for p in run.params}`
|
||
(dict) before the loop — O(1) key check per param. The error-path at line 1616 does a linear
|
||
scan but only executes on IntegrityError (rare, not on the hot path).
|
||
|
||
**`record_logged_model`** (`sqlalchemy_store.py:1961`): `[t for t in run.tags if t.key == MLFLOW_LOGGED_MODELS]`
|
||
is O(T) over tags for a single call — not inside a loop, no quadratic composition.
|
||
|
||
**`_set_tags`** (`sqlalchemy_store.py:1762`): Uses `.in_([t.key for t in tags])` — SQL-level bulk
|
||
operation, not Python list membership in a loop.
|
||
|
||
**Projects** (`_project_spec.py`): Step dependency resolution uses dict-based parameter lookups,
|
||
no list membership inside loops.
|
||
|
||
## Conclusion
|
||
|
||
MLflow's hot paths use dicts, SQL set operations, and SQLAlchemy queries for all bulk lookups.
|
||
No CWE-407 (O(N) linear membership inside a loop) defects found.
|