22 lines
1.4 KiB
Markdown
22 lines
1.4 KiB
Markdown
# UNDF: UNDF-2026-000000505
|
||
# pulsar deeper scan — CWE-407 triage
|
||
|
||
## Scan date: 2026-03-27
|
||
|
||
## Areas scanned
|
||
|
||
| Path | Result |
|
||
|------|--------|
|
||
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/service/` | CLEAN — consumerList.contains guarded by consumerSet (HashSet), membership check deferred to Set |
|
||
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/resourcegroup/ResourceUsageTopicTransportManager.java` | CLEAN — tenantList.contains and nsList.contains are one-shot checks at startup, not in a loop |
|
||
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/loadbalance/` | CLEAN — no ArrayList.contains in loops found |
|
||
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/` | CLEAN |
|
||
| `pulsar-broker/src/main/java/org/apache/pulsar/broker/namespace/` | CLEAN |
|
||
| `pulsar-client/src/main/java/org/apache/pulsar/client/impl/customroute/PartialRoundRobinMessageRouterImpl.java` | **pulsar-0005** — CopyOnWriteArrayList.contains in O(N) stream filter |
|
||
| `pulsar-client/src/main/java/` (rest) | CLEAN — sharedResources.contains is on a small enum-backed list |
|
||
| `managed-ledger/src/main/java/` | CLEAN — String.contains (substring match), not collection membership |
|
||
| `pulsar-common/src/main/java/` | CLEAN |
|
||
|
||
## Defect found
|
||
|
||
- **pulsar-0005**: `PartialRoundRobinMessageRouterImpl.java` CopyOnWriteArrayList.contains O(N×L) — patched, 3/3 PASS, 18×–71× measured
|