russell@unturf.com 5b5355cb07 infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN

consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet

6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza

2026-03-29 19:54:13 -04:00

693 B

Raw Blame History

containerd — CWE-407 Scan Result: CLEAN

Scanned 2026-03-29.

Findings

slices.Contains is used in several paths (mount options, capabilities, snapshotter capabilities, platform lists) but all target lists are small and bounded (typically < 10 elements): mount option flags, GID lists, network namespace types.

No O(N²) patterns in hot paths (content ingestion, snapshot chain management, layer unpacking). The cacheResultStorage.HasLink() in remotecache/v1/cachestorage.go calls slices.Contains(it.links[l], target) but it.links[l] is a deduplicated list of cache targets per link key — bounded in practice.

Verdict: CLEAN — no CWE-407 defects warranting a patch.

693 B Raw Blame History

containerd — CWE-407 Scan Result: CLEAN

Findings

693 B

Raw Blame History