engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/thrift/patch/CLEAN.md

1 KiB
Raw Blame History

CLEAN — Apache Thrift

Scanned 2026-03-29 for CWE-407.

Scope

  • lib/java/src/main/java — Java runtime library (PartialThriftComparer, TBase implementations)
  • compiler/cpp/src/thrift/parse/ — C++ IDL compiler (t_scope.h, t_program.h, t_const_value.h)

Findings

Location Pattern Type Result
PartialThriftComparer.areEqual (Set path) s2.contains(e1) in loop over s1 s2 is Set<Object> (Java Set semantics per Thrift spec) CLEAN
t_scope.h types_.find, services_.find, constants_.find std::map — O(log N) CLEAN
t_program.h namespace lookups std::map CLEAN
contrib/thrift-maven-plugin thriftPathElements.contains Called once per directory during classpath building, not in hot loop LOW

The Java library is minimal and the C++ compiler uses std::map (ordered map, O(log N) find). No quadratic list-membership pattern exists in the production hot path.

Result: No actionable CWE-407 defects.