russell@unturf.com
95008feda5
litellm-0001: ProxyConfig._delete_deployment() checks model_id not in combined_id_list (a plain Python list) for each router model ID during config refresh. O(R*C) where R=router models, C=combined list. Fix: convert to set before loop. MEDIUM severity, 6.5x at N=500. 1/1 PASS. Haystack: no CWE-407 defects found. Uses dicts and sets throughout for membership checks (scheduled_components set, storage dict, etc.).
18 lines
840 B
Markdown
18 lines
840 B
Markdown
# Haystack - CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned: 2026-03-30
|
|
Target: https://github.com/deepset-ai/haystack (depth=1)
|
|
Focus: pipeline component dedup, document store dedup, retriever result dedup, node connection membership
|
|
|
|
## Findings
|
|
|
|
No CWE-407 defects found. The codebase uses appropriate data structures throughout:
|
|
|
|
- Pipeline scheduler uses `set()` for `scheduled_components` (async_pipeline.py:214)
|
|
- Breakpoint validation uses `set()` for component validation (breakpoint.py:97,100)
|
|
- Document store uses `dict` for ID lookups (in_memory/document_store.py)
|
|
- Embedding dedup uses `dict` for `doc_ids_to_embeddings`
|
|
- Graph nodes/edges use NetworkX dict-based adjacency
|
|
- `model_names` equivalent lookups use dict views
|
|
|
|
The deepset team has made good data structure choices. No linear-scan-in-loop patterns found on any hot path.
|