russell@unturf.com cb853893e5 minio: 3 CWE-407 defects; etcd: CLEAN (deeper scan)

minio-0001: healingTracker.isHealed() slices.Contains O(B×H) MEDIUM 25x
minio-0002: isBucketDecommissioned() slices.Contains O(P×D) MEDIUM 24x
minio-0003: isGroupDescEqual/isUserInfoEqual slices.Contains O(M²) MEDIUM 13x
etcd: maps + interval trees throughout; no CWE-407 defects found

2026-03-30 10:24:48 -04:00

1,021 B

Raw Blame History

etcd — CWE-407 Deep Scan: CLEAN

Date: 2026-03-30 Scanned areas:

server/auth/ — interval tree (adt.IntervalTree) for permission checking, O(log N)
server/lease/ — map[LeaseID]*Lease and map[LeaseItem]LeaseID for O(1) lookup
server/storage/mvcc/ — watcherSet (map[*watcher]struct{}), interval tree for key ranges
server/storage/backend/ — bucketBuffer.dedupe() uses sort+unique O(N log N)
server/etcdserver/api/membership/ — map[types.ID]*Member and map[types.ID]bool
server/etcdserver/api/v3rpc/watch.go — map-based watch ID tracking
server/etcdserver/api/v2store/ — set.StringSet (map-backed) for readonlySet
server/proxy/grpcproxy/ — map[*watchBroadcast]struct{} and map[*watcher]*watchBroadcast
client/v3/ — no linear membership patterns

Conclusion: etcd uses maps, interval trees, and proper O(1)/O(log N) data structures throughout its hot paths. The only slices.Contains calls are in startup/config code with small fixed-size inputs. No CWE-407 defects found.

1,021 B Raw Blame History

etcd — CWE-407 Deep Scan: CLEAN

1,021 B

Raw Blame History