23 lines
1.7 KiB
Markdown
23 lines
1.7 KiB
Markdown
# UNDF: UNDF-2026-000000131
|
||
# kafka deeper scan — CWE-407 triage
|
||
|
||
## Scan date: 2026-03-27
|
||
|
||
## Areas scanned
|
||
|
||
| Path | Result |
|
||
|------|--------|
|
||
| `clients/src/main/java/org/apache/kafka/clients/` | **kafka-0008 found** (ListDeserializer) |
|
||
| `clients/src/main/java/org/apache/kafka/common/Cluster.java` | CLEAN — Arrays.asList().contains() in nodeIfOnline is O(R) per call, R bounded by replication factor (≤3), not quadratic |
|
||
| `clients/src/main/java/org/apache/kafka/common/serialization/ListDeserializer.java` | **kafka-0008** — nullIndexList ArrayList.contains in O(S) loop |
|
||
| `clients/src/main/java/org/apache/kafka/clients/admin/internals/ListOffsetsHandler.java` | CLEAN — retriable is HashSet |
|
||
| `connect/runtime/src/main/java/org/apache/kafka/connect/connector/policy/AllowlistConnectorClientConfigOverridePolicy.java` | LOW / skip — allowlist is admin-configured small static list, C×A bounded |
|
||
| `connect/runtime/src/main/java/org/apache/kafka/connect/runtime/rest/RestServer.java` | CLEAN — listeners is a short list of protocol strings, O(1) in practice |
|
||
| `core/src/main/scala/kafka/server/KafkaApis.scala` | CLEAN — topicIdPartitionSeq is `mutable.Set` (HashSet-backed), contains O(1) |
|
||
| `core/src/main/scala/kafka/server/ConfigAdminManager.scala` | CLEAN — alterConfigOps is per-op (single config), oldValueList is a short CSV value list, not partition-scale |
|
||
| `core/src/main/scala/kafka/server/KafkaConfig.scala` | CLEAN — listener name checks on small config lists |
|
||
| `streams/src/main/java/` | CLEAN — no ArrayList.contains in loops found |
|
||
|
||
## Defect found
|
||
|
||
- **kafka-0008**: `ListDeserializer.java` nullIndexList `ArrayList.contains` O(S×N) — patched, 3/3 PASS, 6×–24× measured
|