russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
35 lines
1.3 KiB
ReStructuredText
35 lines
1.3 KiB
ReStructuredText
OpenDaylight — CWE-407 Analysis
|
|
=================================
|
|
|
|
.. contents:: :local:
|
|
|
|
Overview
|
|
--------
|
|
|
|
OpenDaylight (ODL) is a Java-based SDN controller platform maintained by the Linux Foundation.
|
|
It provides northbound APIs for network applications and southbound plugins for network devices,
|
|
including graph topology management and BGP/PCEP path computation.
|
|
|
|
Status: **CLEAN** (scanned 2026-03-23)
|
|
---------------------------------------
|
|
|
|
No candidates found in ``mdsal`` or ``bgpcep``. No CWE-407 defects identified.
|
|
|
|
Triage Notes
|
|
------------
|
|
|
|
Two repositories were scanned: ``mdsal`` (Model-Driven Service Abstraction Layer — ODL's
|
|
core data-binding and topology framework) and ``bgpcep`` (BGP/PCEP/BMP plugin).
|
|
|
|
Neither repository showed ``ArrayList.contains`` or ``List.indexOf`` near graph traversal
|
|
keywords. Both use modern Java collections — ``HashSet``, ``LinkedHashSet``, ``HashMap`` —
|
|
for visited-state tracking throughout their graph and topology algorithms.
|
|
|
|
Consistent with the ONOS finding: application-layer Java SDN infrastructure written after
|
|
Java 5 uses idiomatic hash collections. The defect pattern targets compiler and build tool
|
|
codebases written in the pre-generics era.
|
|
|
|
References
|
|
----------
|
|
|
|
* Scan result: ``tools/scan-results/opendaylight.txt``
|