3 KiB
RabbitMQ CWE-407 Scan — CLEAN (deeper scan, beyond rmq-0004)
Date: 2026-03-27
Repo: https://github.com/rabbitmq/rabbitmq-server
Scan scope: deps/rabbit/src/rabbit_queue_index.erl (renamed; checked rabbit_classic_queue_index_v2.erl), rabbit_exchange.erl, rabbit_channel.erl, rabbit_stream_queue.erl, rabbit_quorum_queue.erl, rabbit_classic_queue.erl, rabbit_amqqueue.erl
Note on rabbit_queue_index.erl
The file rabbit_queue_index.erl no longer exists at the scan URL — it was replaced by
rabbit_classic_queue_index_v2.erl in current main.
Findings
No new confirmed CWE-407 defects found beyond existing rmq-0001 through rmq-0004.
Candidates examined
| File | Location | Pattern | Verdict |
|---|---|---|---|
rabbit_exchange.erl |
serialise_events/1 |
lists:any(fun (M) -> M:serialise_events(X) end, ...) — iterates over a small, bounded list of exchange type modules |
CLEAN (bounded) |
rabbit_channel.erl |
check_resource_access/4 |
lists:member(V, Cache) in per-operation permission check — Cache is bounded by ?MAX_PERMISSION_CACHE_SIZE = 12; O(12) = O(1) |
CLEAN (bounded) |
rabbit_channel.erl |
check_topic_authorisation/5 |
lists:member({Resource, Context, Permission}, Cache) — same bounded 12-entry cache |
CLEAN (bounded) |
rabbit_classic_queue_index_v2.erl |
ack_delete_fold_fun/3 |
lists:member(SeqId div SegmentEntryCount, Deletes) inside maps:fold over WriteBuffer — O(W×D) where W=write buffer entries, D=deleted segments; Deletes is almost always empty or 1 entry; only triggered when a segment is fully acked; LOW severity, not a hot per-message path |
CLEAN (rare path, bounded in practice) |
rabbit_classic_queue.erl |
handle_event(down, ...) |
lists:member(Pid, Status#msg_status.pending) in maps:fold over unconfirmed — but pending is always [QPid] (1-element list per qpids/3); O(M×1) = O(M) |
CLEAN (1-element list) |
rabbit_stream_queue.erl |
grow/4 |
lists:member(Node, Nodes) in list comprehension per queue — Nodes is queue replica set (typically 1–5); called in management operations |
CLEAN (bounded) |
rabbit_quorum_queue.erl |
cleanup_data_dir/0 |
lists:member(Name, Running) for each Registered ra server — O(R×Q); maintenance/startup path, not per-message |
CLEAN (admin path) |
rabbit_amqqueue.erl |
check_declare_arguments/3 |
lists:filter(fun({Arg,_}) -> lists:member(Arg, QueueTypeArgs) end, ...) — O(A×T); called once per queue declare, not per message |
CLEAN (declare-time) |
Summary
The permission cache in rabbit_channel.erl has a constant-bounded lists:member
(max 12 elements). The ack_delete_fold_fun in rabbit_classic_queue_index_v2.erl
has a theoretical O(W×D) complexity but D (deleted segments) is almost always 0 or 1
in normal operation and the code path is only entered on full-segment ack completion.
No hot per-message O(N²) patterns found beyond the four already patched defects.