russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
36 lines
1.2 KiB
ReStructuredText
36 lines
1.2 KiB
ReStructuredText
ONOS (Open Network Operating System) — CWE-407 Analysis
|
|
=========================================================
|
|
|
|
.. contents:: :local:
|
|
|
|
Overview
|
|
--------
|
|
|
|
ONOS is a Java-based software-defined networking (SDN) operating system used by carriers and
|
|
research networks. It manages network topology, flow programming, and path computation for
|
|
OpenFlow and P4-capable switches.
|
|
|
|
Status: **CLEAN** (scanned 2026-03-23)
|
|
---------------------------------------
|
|
|
|
No candidates found. No CWE-407 defects identified.
|
|
|
|
Triage Notes
|
|
------------
|
|
|
|
The scan targeted ``core/api``, ``core/net``, and ``apps/routing`` — the topology engine,
|
|
intent compiler, and routing application. No ``ArrayList.contains`` or ``List.indexOf`` calls
|
|
appeared near graph traversal keywords in any scanned directory.
|
|
|
|
ONOS's ``onlab.graph`` package (Dijkstra, DFS, BFS, Tarjan SCC) uses ``HashSet``-backed
|
|
visited sets throughout, consistent with modern Java practice. The SDN controller space is
|
|
clean on this metric.
|
|
|
|
The Java CWE-407 pattern is concentrated in **compilers and build tools** written in the
|
|
pre-generics era (javac, Kotlin compiler, Scala 3, Maven), not in application-layer
|
|
infrastructure written after Java 5.
|
|
|
|
References
|
|
----------
|
|
|
|
* Scan result: ``tools/scan-results/onos.txt``
|