engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/beam/patch/CLEAN.md

1.5 KiB
Raw Blame History

CLEAN — Apache Beam

Scanned 2026-03-29 for CWE-407.

Scope

  • sdks/java/core/src/main/java — PCollection DAG, PTransform graph, GreedyStageFuser
  • runners/core-java/src/main/java — InMemoryStateInternals, SimplePushbackSideInputDoFnRunner, WatermarkHold
  • runners/google-cloud-dataflow-java/src/main/java — DataflowRunner, DataflowPipelineTranslator
  • runners/google-cloud-dataflow-java/worker/src/main/java — WindmillOrderedList
  • runners/jet/src/main/java — DAGBuilder

Findings

Location Pattern Type Result
GreedyStageFuser fusedCollections.contains / materializedPCollections.contains LinkedHashSet CLEAN
DAGBuilder.sideInputCollections contains per edge HashSet<String> CLEAN
WindmillOrderedList.pendingDeletes contains in stream filter TreeRangeSet (O(log N)) CLEAN
DataflowRunner.experiments experiments.contains(...) List<String> — called at job-submission time (once), not in hot loop LOW — startup only
InMemoryStateInternals.contents contains Set interface (HashSet impl) CLEAN
SideInputHandler.readyWindows contains CopyOnWriteArraySet CLEAN

The DataflowRunner.experiments pattern makes several List<String>.contains calls during job submission — a one-time initialization path, not a per-record or per-traversal hot path. Not actionable as CWE-407.

Result: No actionable CWE-407 defects.