russell@unturf.com 5b5355cb07 infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN

consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet

6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza

2026-03-29 19:54:13 -04:00

543 B

Raw Blame History

buildkit — CWE-407 Scan Result: CLEAN

Scanned 2026-03-29.

Findings

No custom slice-contains helpers. slices.Contains and slices.ContainsFunc used in bounded contexts (compression type checks, platform filtering, annotation repository dedup per descriptor — the existingRepos list is rebuilt from comma-separated annotations per descriptor, not accumulated across descriptors).

Graph traversal in remotecache/v1/parse.go uses a map[int]struct{} visited set.

Verdict: CLEAN — no CWE-407 defects warranting a patch.

543 B Raw Blame History

buildkit — CWE-407 Scan Result: CLEAN

Findings

543 B

Raw Blame History