java-topology/defects/beam/patch/CLEAN.md

Apache Beam — CWE-407 Scan Result: CLEAN

Date: 2026-03-30 Scanner: agent blackops Scope: sdks/java/core/src/main/java/, runners/

Summary

Apache Beam's Java SDK and runners are clean of CWE-407 algorithmic complexity defects. The codebase consistently uses HashSet/LinkedHashSet for membership tests in graph traversal, pipeline fusion, and transform hierarchy operations.

Key observations

• GreedyStageFuser: uses LinkedHashSet for fusedCollections/materializedPCollections
• GreedyPipelineFuser: uses LinkedHashSet/HashSet throughout; has O(N²) comment at groupSiblings but this is inherent sibling compatibility checking, not a membership defect
• Networks: uses visitedNodes Set for BFS reachability
• TransformHierarchy: all visited tracking uses Set<Node>
• PipelineTranslation: viewTransforms is HashSet<String>
• Schema.indexOf(): backed by fieldIndices HashMap
• PipelineOptionsFactory: uses HashSet for usedDescriptors, ImmutableSet for IGNORED_METHODS
• ExperimentContext: uses EnumSet for experiment lookup
• DataflowRunner.stageArtifacts: uses HashSet for stagedNames dedup
• CombineFns.checkUniqueness: List.contains() but N is number of composed combiners (2-5)

No data-proportional linear scans inside loops found.