# UNDF: UNDF-2026-000000418
# httpd-0002 — mod_proxy NoProxy/DirectConnect config-parse O(N²) dedup

## Metadata

| Field       | Value |
|-------------|-------|
| ID          | httpd-0002 |
| Severity    | MEDIUM |
| Component   | modules/proxy/mod_proxy.c |
| Functions   | `set_proxy_exclude`, `set_proxy_dirconn` |
| Complexity  | O(N²) config-parse time |
| CWE         | CWE-407 Inefficient Algorithmic Complexity |
| Status      | PATCHED |

## Description

`set_proxy_exclude` (handler for `NoProxy` directives) and `set_proxy_dirconn`
(handler for `ProxyDirectConnect` directives) each perform a full linear scan
of the existing array before inserting a new entry, to avoid duplicates:

```c
/* set_proxy_exclude — modules/proxy/mod_proxy.c */
for (i = 0; i < conf->noproxies->nelts; i++) {
    if (strcasecmp(arg, list[i].name) == 0) {
        found = 1;
        break;
    }
}
```

With N directives in httpd.conf the total comparison count is:
  0 + 1 + 2 + … + (N-1) = N(N-1)/2 = O(N²)

Both functions share the same pattern. In typical deployments N is small
(< 20), but in automated config generation, container orchestration, or
large reverse-proxy farms the count can reach hundreds or thousands.

## Impact

- **Config parse time** (not request time): server startup / graceful reload
  is slower than necessary when many `NoProxy` or `ProxyDirectConnect`
  directives are present.
- A generated config with 1 000 entries does ~500 000 strcasecmp calls
  instead of ~1 000 hash probes.

## Root Cause

APR arrays have no built-in set semantics; the dedup loop is the standard
APR idiom but was never replaced with a hash table as the directive lists grew.

## Fix

Replace the APR array + linear dedup with an `apr_hash_t` keyed on the
lowercased hostname/entry string.  The array can be kept for ordered iteration
at request time; the hash is used only during config parsing for O(1) dedup.

```c
/* Proposed replacement in set_proxy_exclude */
apr_hash_t *noproxy_set = ap_get_noproxy_set(conf, parms->pool);
char *lower = apr_pstrdup(parms->pool, arg);
ap_str_tolower(lower);
if (apr_hash_get(noproxy_set, lower, APR_HASH_KEY_STRING)) {
    return NULL;  /* duplicate — skip */
}
apr_hash_set(noproxy_set, lower, APR_HASH_KEY_STRING, (void *)1);
/* then push to conf->noproxies as before */
```

## Measured Overhead

See unit test `HttpdProxyNoproxyTest.java`:
- N=500 entries: SLOW=124 750 ops, FAST=500 ops, ratio=249.5x
