1.7 KiB
1.7 KiB
UNDF: UNDF-2026-000000392
etcd CWE-407 Scan — CLEAN
Date: 2026-03-27
Repo: https://github.com/etcd-io/etcd
Scan scope: server/etcdserver/, client/v3/, pkg/, server/storage/mvcc/
Findings
No confirmed CWE-407 defects in production code paths.
Candidates examined
| File | Line | Pattern | Verdict |
|---|---|---|---|
client/pkg/logutil/zap.go |
86 | slices.Contains(old, "/dev/null") — called once in mergePaths, not inside a scaling loop |
CLEAN |
tools/proto-annotations/cmd/etcd_version.go |
76 | slices.Contains(externalPackages, pkg) inside RangeFiles callback — externalPackages is a constant 8-element slice; O(8N) = O(N) |
CLEAN |
tests/robustness/traffic/key_store.go |
132 | slices.Contains(listKeys, key) inside for _, key := range k.keys — genuine O(K*L) dedup pattern, but this is test infrastructure (robustness driver), not a production code path |
CLEAN (test-only) |
server/etcdserver/api/membership/cluster.go |
770–782 | ValidateClusterAndAssignIDs: O(N²) peer URL matching — N is cluster member count, bounded ≤ 7 in practice; also a startup/reconfig path, not a hot loop |
CLEAN (bounded) |
server/storage/mvcc/watcher_group.go |
184–186 | watcherGroup.contains: uses map[string]watcherSet (O(1)) + IntervalTree.Intersects (O(log N)) |
CLEAN |
server/storage/mvcc/watchable_store.go |
450 | c.contains(key) — delegates to watcherGroup.contains, O(1)/O(log N) |
CLEAN |
Summary
etcd's watcher and membership machinery uses maps and interval trees for membership tests. No linear slice scans appear inside scaling loops in production code.