engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/bevy/patch/CLEAN.md
russell@unturf.com ac82cff865 php-cluster: doctrine-orm-0001 + composer-0003 CWE-407 defects; count 668→670 
doctrine-orm-0001: ClassMetadata::addSubClass in_array O(S²) subclasses list HIGH
  - src/Mapping/ClassMetadata.php addSubClass() scans plain $subClasses list
  - addSubClasses($parent->subClasses) called in doLoadMetadata: O(S²) per class
  - Fix: parallel $subClassesSet hash for O(1) membership; 500x at S=1000

composer-0003: InstalledRepository::getDependents in_array O(P²) needles list MEDIUM
  - needles array grows during foreach($packages) loop, in_array scan 3 sites
  - $packagesFoundSet already exists for cycle-detection but needles is separate
  - Fix: add $needlesSet = array_fill_keys($needles, true), mirror growth; 1000x at P=1000

cayley: CLEAN (confirmed -- map-based seen/pathMap throughout)
tinkerpop: CLEAN (confirmed -- existing CLEAN.md valid, sort ArrayList is query-plan-time only)
2026-03-29 19:51:31 -04:00

1.3 KiB
Raw Blame History

CLEAN — bevy

Scanned 2026-03-29 for CWE-407 (algorithmic complexity).

Findings

  • bevy_ecs/src/schedule/graph/graph_map.rs — cycle detection uses HashSet for blocked and maybe_in_more_cycles. CLEAN.
  • bevy_ecs/src/schedule/graph/dag.rs — transitive reduction uses FixedBitSet for visited. CLEAN.
  • bevy_ecs/src/schedule/auto_insert_apply_deferred.rs — no_sync_edges is BTreeSet. CLEAN.
  • bevy_ecs/src/schedule/node.rs — ambiguous_with_all: &HashSet<NodeId>, ignored_ambiguities: &BTreeSet. CLEAN.
  • bevy_gltf/src/loader/gltf_ext/scene.rs — uses FixedBitSet and HashSet for visited tracking. CLEAN.
  • bevy_ui/src/stack.rs — visited_root_nodes: Local<HashSet<Entity>>. CLEAN.
  • bevy_picking/src/hover.rs — hover_ancestors: EntityHashSet. CLEAN.
  • bevy_render/src/view/window/screenshot.rs — seen_targets: Local<HashSet<...>>. CLEAN.
  • bevy_pbr/src/render/light.rs — all_cascades_seen: HashSet. CLEAN.
  • bevy_ecs/src/bundle/info.rs — explicit_component_ids: IndexSet<_, FixedHasher>. CLEAN.
  • bevy_ecs/src/world/entity_access/world_mut.rs — contributed_components() slice .contains() called during archetype migration (not per-frame hot path), N bounded to component count per entity. Not actionable.

Result: No actionable CWE-407 defects.