engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/jgit/CLEAN.md

3 KiB
Raw Blame History

JGit — CWE-407 scan result: CLEAN

Scan date: 2026-03-27

Files scanned

  • org.eclipse.jgit/src/org/eclipse/jgit/internal/revwalk/PedestrianObjectReachabilityChecker.java — uses RevWalk with markUninteresting; no list membership in object loop
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/revwalk/BitmappedReachabilityChecker.java — BitmapBuilder for reached set, O(1) contains; remainingTargets ArrayList but removeIf bounded by #targets, not repository scale
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/pack/PackWriter.java — have/want are Set<? extends ObjectId> (HashSet), O(1)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/pack/PackWriterBitmapPreparer.java — excessiveBranches is HashSet, newWants is HashSet, O(1)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/pack/PackBitmapCalculator.java — bitmap operations only
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/RefDirectory.java — RefList.contains uses binary search O(log N)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/ObjectDirectory.java — skips is HashSet<AlternateHandle.Id>, O(1)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackDirectory.java — indexOf in remove() is single call, not inside a loop proportional to pack count
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/GC.java — existing/objectsToKeep/seenParentIds are HashSet, O(1)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/CachedObjectDirectory.java — unpackedObjects is ObjectIdOwnerMap (hashmap), O(1)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/reftable/ReftableDatabase.java — deleted is HashSet, added is TreeSet (O(log N)), ceiling() is O(log N)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/reftable/ReftableBatchRefUpdate.java — checkConflicting uses TreeSet added and HashSet deleted, O(log N)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/reftable/ReftableWriter.java — LongList.contains is O(B) where B = #blocks per OID (typically 1-3), not repository scale
  • org.eclipse.jgit/src/org/eclipse/jgit/lib/RefDatabase.java — getConflictingNames uses allRefs.keySet() which is a Map, containsKey is O(1)
  • org.eclipse.jgit/src/org/eclipse/jgit/lib/ObjectChecker.java — EnumSet and ObjectIdSet, O(1)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/dfs/MidxPackFilter.java — coveredPacksAndMidxs is HashSet, O(1)
  • org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/dfs/DfsPackCompactor.java — packs and reftables are HashSet, O(1)

Conclusion

No unbounded O(n²) membership defects found in the scanned JGit files. All hot-path membership tests use hash structures (HashSet, ObjectIdOwnerMap, ObjectIdSet, EnumSet) or sorted/binary-search structures (TreeSet, RefList).

The LongList.contains in ReftableWriter.addBlock is O(B) but B is bounded by the number of pack file blocks containing a given OID, which is effectively constant (1-3) in practice — not proportional to repository scale.