russell@unturf.com
8a85da480d
micronaut-0004: AbstractAnnotationMetadataBuilder.processAnnotation O(2^D) diamond recursion in meta-annotation stereotype traversal. isProcessed() guard tracks only current-path ancestors, not globally visited nodes — diamond meta-annotation hierarchies cause exponential re-visits of shared base annotations (e.g. @Transactional + @Retryable both extend @InterceptorBinding). 13x at D=8, 41x at D=10. 10/10 unit tests PASS. quarkus-0003 unit tests: added to QuarkusTest.java for the existing quarkus-0003 BeanDeployment.recursiveBuild diamond defect. 9/9 PASS. CLEAN markers: camel, hazelcast, tomcat, undertow, vertx — no diamond recursion pattern found. Hazelcast uses proper Tarjan algorithm. Tomcat uses iterative constraint propagation.
21 lines
1.1 KiB
Markdown
21 lines
1.1 KiB
Markdown
# Hazelcast — Diamond Recursion (CWE-407 O(2^D)) Scan: CLEAN
|
|
|
|
**Pattern:** Recursive cycle-detection / dependency traversal without a visited set
|
|
(exponential re-visitation on diamond-shaped DAGs)
|
|
**Scan date:** 2026-03-29
|
|
**Scope:** `hazelcast/src/main/java/` — partition management, Jet DAG, service manager, SQL
|
|
|
|
## Methods Checked
|
|
|
|
| Method | Location | Guard | Result |
|
|
|--------|----------|-------|--------|
|
|
| `isCyclic(PartitionReplica[], PartitionReplica[], int)` | `MigrationPlanner.java:369` | Iterative loop with index tracking (no recursion) | CLEAN |
|
|
| `TopologicalSorter.strongConnect` | `TopologicalSorter.java` | Tarjan's algorithm — `tv.index != -1` visited guard | CLEAN |
|
|
| `checkTopologicalSort` | `TopologicalSorter.java` | `Set<V> seen` | CLEAN |
|
|
| `ServiceManagerImpl` service ordering | `ServiceManagerImpl.java` | No recursive dependency traversal found | CLEAN |
|
|
|
|
## Conclusion
|
|
|
|
Hazelcast Jet uses a proper Tarjan strongly-connected-components algorithm for cycle detection
|
|
in its DAG processor. The `MigrationPlanner.isCyclic` uses an iterative while-loop (not
|
|
recursive). No diamond-recursion pattern was found.
|