38 lines
3.4 KiB
Markdown
38 lines
3.4 KiB
Markdown
# UNDF: UNDF-2026-000000350
|
|
# ActiveMQ Artemis CWE-407 Scan — CLEAN (beyond artemis-0001)
|
|
|
|
**Date:** 2026-03-28
|
|
**Repo:** https://github.com/apache/activemq-artemis
|
|
**Scan scope:** `artemis-server/src/main/java/org/apache/activemq/artemis/core/` —
|
|
postoffice, server/impl, paging, persistence, security, transaction, replication, cluster,
|
|
filter, group; plus `artemis-protocols/` (AMQP, OpenWire, STOMP).
|
|
|
|
## Findings
|
|
|
|
No new confirmed CWE-407 defects found beyond existing artemis-0001.
|
|
|
|
### Candidates examined
|
|
|
|
| File | Location | Pattern | Verdict |
|
|
|------|----------|---------|---------|
|
|
| `BindingsImpl.java` | `routeFromCluster` | `idsToAckList.contains(bindingID)` in byte-buffer loop | PATCHED (artemis-0001) |
|
|
| `RoutingContextImpl.java` | `RouteContextList.ackedQueues` | `ackedQueues.contains(queue)` (ArrayList) called from `processRouteToDurableQueues` | CLEAN — `ackedQueues` is populated via `addQueueWithAck` which is called once per `QueueImpl.routeWithAck`; list remains ≤1 entry per address per routing context (durable queue ArrayList is sized `(1)`). Not an outer loop over a growing list. |
|
|
| `RemoteQueueBindingImpl.java` | `route()` | `getDurableQueues().contains(storeAndForwardQueue)` | CLEAN — `durableQueue` is `ArrayList(1)`; O(1) scan for a list bounded to 1 element per address. |
|
|
| `ClusterConnectionImpl.java` | `nodeUP()` | `allowableConnections.contains(...)` | CLEAN — `allowableConnections` is `HashSet`; O(1). |
|
|
| `ColocatedHAManager.java` | `updateAcceptorsAndConnectors` | `remoteConnectors.contains(entry.getValue().getName())` in connector loop | CLEAN — admin/startup path only; connector counts are bounded (single-digit). |
|
|
| `MBeanInfoHelper.java` | `getMBeanAttributesInfo` | `alreadyAdded.contains(name)` in nested loop over methods | CLEAN — results are cached in `attributesInfoCache`; called once per MBean interface class at registration time, not per-message. |
|
|
| `SecurityStoreImpl.java` | `checkAuthorizationCache` | `act.contains(dest)` | CLEAN — `act` is `ConcurrentHashSet`; O(1). |
|
|
| `QueueImpl.java` | `transferTo` | `targetDuplicateCache.contains(duplicateBytes)` | CLEAN — `DuplicateIDCache` uses `ConcurrentHashMap`; O(1). |
|
|
| `PageCursorProviderImpl.java` | `cleanupMiddleStream` | `depagedPagesSet.contains(pageID)` | CLEAN — `depagedPagesSet` is `LongHashSet`; O(1). |
|
|
| `AMQPMessage.java` | `isAccepted` | `rejectedConsumers.contains(consumer)` | CLEAN — `rejectedConsumers` is `HashSet`; O(1). |
|
|
| `AMQPFederationAddressPolicyManager.java` | `afterQueueAdded` | `divert.getValue().contains(queueBinding)` | CLEAN — value is `Set<QueueBinding>`; O(1). |
|
|
| `AMQConsumer.java` | `isRolledBack` | `rollbackedMessageRefs.contains(ref)` | CLEAN — `rollbackedMessageRefs` is `Set`; O(1). |
|
|
| `ArtemisRbacInvocationHandler.java` | `invoke` | `mBeanServerCheckedMethods.contains(...)` | CLEAN — `List.of(...)` with 7 static entries; effectively O(1). |
|
|
| `ResourceManagerImpl.java` | `getHeuristicCommittedTransactions` | `List<Xid>` returned, then `.contains()` called by `ServerSessionImpl` | CLEAN — heuristic completions list is always tiny (admin-path, zero in normal operation). |
|
|
|
|
## Summary
|
|
|
|
All `ArrayList.contains()` / `List.contains()` patterns found in the hot message routing
|
|
paths use sets, maps, bounded lists, or cached structures. The single confirmed defect
|
|
(artemis-0001, `routeFromCluster` `idsToAckList`) has been patched. No further
|
|
CWE-407 defects found in the Artemis codebase within scan scope.
|