russell@unturf.com
8a85da480d
micronaut-0004: AbstractAnnotationMetadataBuilder.processAnnotation O(2^D) diamond recursion in meta-annotation stereotype traversal. isProcessed() guard tracks only current-path ancestors, not globally visited nodes — diamond meta-annotation hierarchies cause exponential re-visits of shared base annotations (e.g. @Transactional + @Retryable both extend @InterceptorBinding). 13x at D=8, 41x at D=10. 10/10 unit tests PASS. quarkus-0003 unit tests: added to QuarkusTest.java for the existing quarkus-0003 BeanDeployment.recursiveBuild diamond defect. 9/9 PASS. CLEAN markers: camel, hazelcast, tomcat, undertow, vertx — no diamond recursion pattern found. Hazelcast uses proper Tarjan algorithm. Tomcat uses iterative constraint propagation.
1.2 KiB
1.2 KiB
Apache Camel — Diamond Recursion (CWE-407 O(2^D)) Scan: CLEAN
Pattern: Recursive cycle-detection / dependency traversal without a visited set
(exponential re-visitation on diamond-shaped DAGs)
Scan date: 2026-03-29
Scope: core/camel-base-engine/, core/camel-core-engine/, core/camel-core-reifier/
Methods Checked
| Method | Location | Guard | Result |
|---|---|---|---|
| Route startup ordering | InternalRouteStartupManager.java |
camel-0001 already patched; ordering uses sorted startup numbers, not recursive graph traversal | CLEAN |
Route dependsOn resolution |
AbstractCamelContext.java |
Uses lifecycle strategy list, not recursive dependency graph | CLEAN |
Bean wiring / CamelPostProcessorHelper |
camel-base-engine |
No recursive graph traversal found | CLEAN |
Conclusion
Apache Camel's route startup ordering is managed by startup order numbers (camel-0001
addressed a quadratic list scan in that ordering). The route dependency (dependsOn) field
in XML DSL is resolved via a topological ordering approach, not recursive traversal without
a visited set. No diamond-recursion pattern was found beyond camel-0001.