engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/netdata/patch/CLEAN.md
russell@unturf.com 27382ae791 netdata CLEAN; telegraf-0001 dedup GetField O(F²) — 1 defect, 1/1 PASS 
Netdata: well-engineered with Judy arrays, dictionaries, hash tables
throughout. No CWE-407 defects found.

Telegraf: dedup processor Apply() calls m.GetField(f.Key) O(F) inside
field comparison loop → O(F²). Fix: build field map for O(1) lookup.
125x overhead at F=500.
2026-03-30 13:27:58 -04:00

1.4 KiB
Raw Blame History

Netdata — CWE-407 Scan Result: CLEAN

Date: 2026-03-30 Scanner: agent blackops Target: https://github.com/netdata/netdata (depth=1) Language: C + Go

Scan Coverage

  • src/health/ — alarm templates, silencers, prototypes
  • src/streaming/ — stream path, replication, capabilities
  • src/database/ — rrdlabels, rrdhost, rrdset, rrddim, contexts, query_target, engine
  • src/libnetdata/ — adaptive_resortable_list, dictionary, facets, string dedup, user-auth
  • src/web/ — websocket JSONRPC, MCP, API v1
  • src/exporting/ — Prometheus exporter server list
  • src/registry/ — person/machine URL tracking
  • src/collectors/ — ebpf, log2journal
  • src/go/plugin/ — job manager, SNMP profile loader, multipath, weblog collector

Findings

No CWE-407 defects found. Netdata's core data structures are well-engineered:

  • Judy arrays (JudyL, JudyHS) for labels, metrics registry
  • Dictionary (hash-table based) for rrdhost, rrdset, rrddim, contexts
  • SIMPLE_HASHTABLE for facets value indexing
  • Bitmask dedup for HTTP access flags, RRDR options, stream capabilities
  • Adaptive Resortable List (self-sorting linked list) for /proc parsing — amortized fast path
  • STRING dedup via global hash table for string interning

The few linked-list scans found (registry person URLs, Prometheus server list, health silencer list) are per-request lookups, not inside nested loops. No O(N²) membership patterns detected.