engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/metabase/patch/CLEAN.md
russell@unturf.com 5c94ac750a superset+metabase: CWE-407 scan — 3 defects in Superset, Metabase CLEAN 
Superset:
- superset-0001: SecurityManager._get_pvms_from_builtin_role pvm list dedup O(Regex*PVMs*R) HIGH 8x
- superset-0002: DashboardDAO.update_native_filters_config filter dedup O(M*U) MEDIUM 40x
- superset-0003: import_datasource metric/column dedup O(N^2) list rebuild MEDIUM 68x

Metabase: CLEAN — Clojure backend uses sets/maps throughout for membership tests
2026-03-30 13:04:14 -04:00

1.3 KiB
Raw Blame History

Metabase — CWE-407 Scan Result: CLEAN

Date: 2026-03-30 Target: Metabase (Clojure + TypeScript/JS frontend) Source: https://github.com/metabase/metabase (depth=1)

Scan Summary

Metabase's Clojure backend makes exemplary use of persistent hash sets and maps for membership testing throughout. Key observations:

  • graph/core.cljc uses LinkedHashSet (.contains is O(1)) for graph traversal
  • Permission checks use contains? on maps/sets (O(1))
  • Dashboard/query code uses (into #{} ...) before membership tests
  • Chain filter dedup uses clojure.set operations
  • Frontend .includes() calls are on small UI-bound arrays (parameters, form fields)

No linear-scan membership test inside a loop found at scale.

Areas Scanned

  • src/metabase/graph/core.cljc -- graph walking, transitive closure
  • src/metabase/security/, src/metabase/permissions/ -- permission models
  • src/metabase/dashboards*/ -- dashboard card/parameter dedup
  • src/metabase/parameters/chain_filter/ -- join deduplication
  • src/metabase/sync/ -- database sync
  • src/metabase/query_processor/ -- query processing pipeline
  • enterprise/backend/src/ -- enterprise features
  • frontend/src/metabase/dashboard/ -- frontend selectors

Verdict

CLEAN -- no CWE-407 defects found.