engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/beam/patch/CLEAN.md
russell@unturf.com 1a1abc2154 beam+hive: CWE-407 scan — Beam CLEAN, Hive 2 defects (mergeSchema + averageColumnSizes) 
Beam: exhaustive scan of sdks/java/core + runners — all membership tests already
use proper Set types (HashSet, LinkedHashSet, ImmutableSet, TreeSet). CLEAN.

Hive hive-0001: SharedWorkOptimizer.mergeSchema() uses List.contains() in loops
for neededColumnIDs/neededColumns/virtualCols dedup. O(D*R) per list. MEDIUM, 3-4x.

Hive hive-0002: HiveRelMdSize.averageColumnSizes() uses ImmutableList.contains(i)
in column loop during Calcite metadata queries. O(C*L). MEDIUM, 3-5x.

Both patched with HashSet wrappers. 2/2 unit tests PASS.
2026-03-30 13:05:40 -04:00

1.2 KiB
Raw Blame History

Apache Beam — CWE-407 Scan Result: CLEAN

Date: 2026-03-30 Target: Apache Beam (Java SDK + Runners) Scope: sdks/java/core/src/main/java/, runners/*/src/main/java/

Summary

No CWE-407 (algorithmic complexity via linear membership test in loop) defects found.

Apache Beam consistently uses proper data structures for membership testing:

  • TransformHierarchy.visit(): Set<PValue> and Set<Node> for visitedValues/visitedNodes
  • PortablePipelineJarCreator.copyResourcesFromJar(): HashSet<String> for previousEntryNames
  • PipelineTranslation: HashSet<String> for viewTransforms
  • GreedyStageFuser: LinkedHashSet for fusedCollections/materializedPCollections
  • Networks.reachableNodes(): HashSet for visitedNodes
  • OutputDeduplicator: HashMultimap for pcollectionProducers
  • SamzaTimerInternalsFactory: TreeSet for eventTimeBuffer
  • DisplayData.Builder: IdentityHashSet for visitedComponents
  • FieldAccessDescriptor.union(): LinkedHashSet for fieldsAccessed
  • PipelineOptionsFactory: ImmutableSet for IGNORED_METHODS, PIPELINE_OPTIONS_FACTORY_CLASSES

Keywords searched

.contains(, .indexOf(, ArrayList, List<, visited, seen, worklist