41 lines
3.5 KiB
Markdown
41 lines
3.5 KiB
Markdown
# UNDF: UNDF-2026-000000136
|
||
# Kubernetes CWE-407 Deep Scan — CLEAN
|
||
|
||
**Date:** 2026-03-27
|
||
**Repo:** https://github.com/openjdk/jdk (sparse clone)
|
||
**Scan scope:** `pkg/scheduler/`, `pkg/controller/`, `staging/src/k8s.io/`
|
||
**Already patched:** kubernetes-0001 through kubernetes-0007
|
||
|
||
## Focus areas
|
||
|
||
| Area | Files examined |
|
||
|------|----------------|
|
||
| `pkg/scheduler/` | backend/queue, framework/plugins (all), backend/cache, framework/preemption |
|
||
| `pkg/controller/` | disruption, job, servicecidrs, garbagecollector, volume/pv, daemon, deployment, statefulset, tainteviction, nodeipam |
|
||
| `staging/src/k8s.io/` | apimachinery, client-go |
|
||
| `plugin/pkg/admission/` | limitranger, scheduling, podgroupprotection |
|
||
|
||
## Candidates examined
|
||
|
||
| File | Line | Pattern | Verdict |
|
||
|------|------|---------|---------|
|
||
| `pkg/controller/garbagecollector/patch.go` | 118 | `for _, ref := range refs { slices.Contains(ownerUIDs, ref.UID) }` — ownerRefs and ownerUIDs are both bounded ≤5 per object | CLEAN (small N) |
|
||
| `pkg/controller/disruption/disruption.go` | 444 | `slices.Contains(expectedGroups, gv.Group)` — called once per PDB owner, expectedGroups is a 2-element constant literal | CLEAN (constant N) |
|
||
| `pkg/controller/job/pod_failure_policy.go` | 126–128 | `for containers { slices.Contains(requirement.Values, exitCode) }` — requirement.Values is user-configured exit code list; already covered by kubernetes-0007 | Already patched |
|
||
| `pkg/controller/volume/persistentvolume/pv_controller_base.go` | 415–439 | `slices.Contains(outFinalizers, ...)` called 3× in `modifyDeletionFinalizers` — outFinalizers is bounded ≤3 items (finalizer strings per PV) | CLEAN (small N) |
|
||
| `pkg/scheduler/framework/plugins/dynamicresources/dynamicresources.go` | 1161,1491 | `slices.Contains(claim.Finalizers, resourceapi.Finalizer)` inside claim allocation loop — Finalizers slice is bounded ≤3 per claim | CLEAN (small N) |
|
||
| `pkg/scheduler/backend/queue/nominator.go` | 102 | `for _, np := range nominatedPods[nodeName] { if np.uid == pod.UID }` — per-node slice, bounded by concurrent preemption candidates (typically <10) | CLEAN (small N) |
|
||
| `pkg/scheduler/framework/plugins/defaultpreemption/default_preemption.go` | 430 | `for podInfos { for pdbs { labelSelector.Matches() } }` — label selector uses compiled regex, not slice scan; PDB count is small | CLEAN (map-based) |
|
||
| `pkg/scheduler/backend/cache/node_tree.go` | 54 | `for _, nodeName := range na { if nodeName == n.Name }` in `addNode` — dedup on node-add event, not scheduling hot path; N = nodes per zone (small) | CLEAN (cold path) |
|
||
| `pkg/apis/core/validation/validation.go` | 1832 | `for _, msg := range IsDNS1123Subdomain() { slices.Contains(opts, ...) }` — opts is 0–3 constant ValidateCSIDriverNameOption values | CLEAN (constant N) |
|
||
| `pkg/controller/servicecidrs/servicecidrs_controller.go` | 394–406 | `for ip in ips { ContainsAddress(lister, ip) }` — O(I×S) at ServiceCIDR deletion time; note `// TODO: optimize this` comment in source | CLEAN (deletion path, small cluster-level N) |
|
||
|
||
## Summary
|
||
|
||
All `slices.Contains` calls in the scanned areas operate on bounded-small slices
|
||
(Finalizers: ≤3, ownerRefs: ≤5, expectedGroups: constant 2, opts: constant 3).
|
||
No new CWE-407 defects found beyond kubernetes-0001 through kubernetes-0007.
|
||
|
||
The `servicecidrs_controller.go` carries an explicit `// TODO: optimize this` comment
|
||
at the `canDeleteServiceCIDR` function but the operation involves cluster-level IP
|
||
counts (not per-request hot path) and N is bounded by cluster size, not request rate.
|