java-topology/defects/spark/patch/spark-0001-analyzer-seenwindowaggregates-linkedhashset.patch
russell@unturf.com 0a580b313d undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
2026-03-26 17:11:57 -04:00

12 lines
1 KiB
Diff

diff --git a/sql/catalyst/src/main/scala/org/apache/spark/sql/catalyst/analysis/Analyzer.scala b/sql/catalyst/src/main/scala/org/apache/spark/sql/catalyst/analysis/Analyzer.scala
--- a/sql/catalyst/src/main/scala/org/apache/spark/sql/catalyst/analysis/Analyzer.scala
+++ b/sql/catalyst/src/main/scala/org/apache/spark/sql/catalyst/analysis/Analyzer.scala
@@ -3283,8 +3283,9 @@ class Analyzer(override val catalogManager: CatalogManager) extends RuleExecuto
// Now, we extract regular expressions from expressionsWithWindowFunctions
// by using extractExpr.
- val seenWindowAggregates = new ArrayBuffer[AggregateExpression]
+ // CWE-407 fix: LinkedHashSet for O(1) contains() instead of O(W) ArrayBuffer scan.
+ // Preserves insertion order for deterministic output; equality via AggregateExpression.equals.
+ val seenWindowAggregates = new mutable.LinkedHashSet[AggregateExpression]
val newExpressionsWithWindowFunctions = expressionsWithWindowFunctions.map {
_.transform {