russell@unturf.com
5b5355cb07
consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet
6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza
580 B
580 B
grafana — CWE-407 Scan Result: CLEAN
Scanned 2026-03-29.
Findings
FolderTree.Contains uses a map index (O(1)). ResourcePermission.Contains is
O(|Actions| × |targetActions|) but both are small fixed permission sets (< 20 items)
and the function is not called in a tight loop over large collections.
ManagedRoutes.Contains is a linear scan but is not called in an outer loop.
Wildcards.Contains walks a sorted slice of wildcard scopes — bounded by the number
of resource permission types (< 50).
Verdict: CLEAN — no CWE-407 defects warranting a patch.