java-topology/defects/rabbitmq/patch/rabbitmq-deeper-CLEAN.md

UNDF: UNDF-2026-000000237

RabbitMQ CWE-407 Scan — CLEAN (deeper scan, beyond rmq-0004)

Date: 2026-03-27 Repo: https://github.com/rabbitmq/rabbitmq-server Scan scope: deps/rabbit/src/rabbit_queue_index.erl (renamed; checked rabbit_classic_queue_index_v2.erl), rabbit_exchange.erl, rabbit_channel.erl, rabbit_stream_queue.erl, rabbit_quorum_queue.erl, rabbit_classic_queue.erl, rabbit_amqqueue.erl

Note on rabbit_queue_index.erl

The file rabbit_queue_index.erl no longer exists at the scan URL — it was replaced by rabbit_classic_queue_index_v2.erl in current main.

Findings

No new confirmed CWE-407 defects found beyond existing rmq-0001 through rmq-0004.

Candidates examined

File	Location	Pattern	Verdict
rabbit_exchange.erl	serialise_events/1	lists:any(fun (M) -> M:serialise_events(X) end, ...) — iterates over a small, bounded list of exchange type modules	CLEAN (bounded)
rabbit_channel.erl	check_resource_access/4	lists:member(V, Cache) in per-operation permission check — Cache is bounded by ?MAX_PERMISSION_CACHE_SIZE = 12; O(12) = O(1)	CLEAN (bounded)
rabbit_channel.erl	check_topic_authorisation/5	lists:member({Resource, Context, Permission}, Cache) — same bounded 12-entry cache	CLEAN (bounded)
rabbit_classic_queue_index_v2.erl	ack_delete_fold_fun/3	lists:member(SeqId div SegmentEntryCount, Deletes) inside maps:fold over WriteBuffer — O(W×D) where W=write buffer entries, D=deleted segments; Deletes is almost always empty or 1 entry; only triggered when a segment is fully acked; LOW severity, not a hot per-message path	CLEAN (rare path, bounded in practice)
rabbit_classic_queue.erl	handle_event(down, ...)	lists:member(Pid, Status#msg_status.pending) in maps:fold over unconfirmed — but pending is always [QPid] (1-element list per qpids/3); O(M×1) = O(M)	CLEAN (1-element list)
rabbit_stream_queue.erl	grow/4	lists:member(Node, Nodes) in list comprehension per queue — Nodes is queue replica set (typically 1–5); called in management operations	CLEAN (bounded)
rabbit_quorum_queue.erl	cleanup_data_dir/0	lists:member(Name, Running) for each Registered ra server — O(R×Q); maintenance/startup path, not per-message	CLEAN (admin path)
rabbit_amqqueue.erl	check_declare_arguments/3	lists:filter(fun({Arg,_}) -> lists:member(Arg, QueueTypeArgs) end, ...) — O(A×T); called once per queue declare, not per message	CLEAN (declare-time)

Summary

The permission cache in rabbit_channel.erl has a constant-bounded lists:member (max 12 elements). The ack_delete_fold_fun in rabbit_classic_queue_index_v2.erl has a theoretical O(W×D) complexity but D (deleted segments) is almost always 0 or 1 in normal operation and the code path is only entered on full-segment ack completion. No hot per-message O(N²) patterns found beyond the four already patched defects.