russell@unturf.com 52a8d535a2 dubbo-0001 + cxf-0001: annotation diamond recursion O(2^D); WSDL import O(N²); count 621→623

dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph
without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238)

cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains
as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237)

Struts, RabbitMQ, Camel: CLEAN

2026-03-29 18:23:19 -04:00

1.3 KiB

Raw Blame History

Apache Camel — CWE-407 Scan Result: CLEAN (beyond camel-0001)

Scan Date: 2026-03-29

Scope

Searched for route dependency traversal, @DependsOn-style annotation handling, and recursive route startup ordering without visited sets. The pre-existing camel-0001 defect (route startup ArrayList O(R²)) is already documented.

Findings

InternalRouteStartupManager

Route startup ordering uses TreeMap and LinkedHashMap for ordering — no recursive traversal of a route dependency graph. Routes are sorted by startupOrder integer value via Comparator, not by graph traversal.

AbstractCamelContextFactoryBean.getDependsOn

getDependsOn() is an abstract method returning a String — just a label for Spring @DependsOn ordering. No Camel-internal graph traversal is performed; Spring's own dependency resolution handles this.

Route dependency shutdown (DefaultShutdownStrategy)

Uses reverse startupOrder sorting — no recursive graph traversal.

TypeUtils / annotation processors

Camel does not use annotation processors for meta-annotation hierarchies in the manner Dubbo does. Camel's @RoutingSlip, @RecipientList etc. are resolved at runtime on flat lists.

Conclusion

CLEAN (beyond pre-existing camel-0001). No additional CWE-407 defects found in Apache Camel route dependency or startup ordering code.

1.3 KiB Raw Blame History