engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/dask/patch/CLEAN.md
russell@unturf.com 7491349edc game-engines: allegro5/bullet3/box2d/dry CWE-407 scan 
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
  per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
  frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)
2026-03-29 19:50:49 -04:00

799 B
Raw Blame History

dask — CWE-407 Scan: CLEAN

Scanned: 2026-03-29

Scope

  • dask/optimization.py — fuse_linear, fuse: seen = set()
  • dask/_task_spec.py — graph traversal: seen = set()
  • dask/highlevelgraph.py — dependency walk: seen = set()
  • dask/dot.py — DAG visualization: seen = set()
  • dask/order.py — transitive_deps dedup: transitive_deps_ids = set() (list used only for ordered iteration, dedup via set)
  • dask/dataframe/dask_expr/_expr.py — ancestors = [] is a pure accumulator list (not used for membership checks; dedup done via seen = set() at line 3192)

Verdict

No CWE-407 (algorithmic complexity / quadratic membership check) defects found. All visited/seen deduplication uses set or dict throughout the task graph traversal and optimization paths.