engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

istio/argo-cd: CWE-407 findings

Browse source 
istio-0001: gateway reportGatewayStatus addressesToReport dedup O(I^2)
  pilot/pkg/config/kube/gateway/conversion.go +
  pilot/pkg/config/kube/agentgateway/gateway_status.go
  Fix: map[string]struct{} seen-set replaces slices.Contains on growing list

argo-cd-0001: mergeIgnoreDifferences O(P^2) per field type
  util/argo/diff/ignore.go
  Fix: pre-compute sets for JQPathExpressions/JSONPointers/ManagedFieldsManagers

Both: 2/2 unit tests PASS; 3.4x and 3.7x speedup measured
This commit is contained in:
russell@unturf.com 2026-03-30 09:53:12 -04:00
parent b31ac644bb
commit 05e6aace95
6 changed files with 352 additions and 142 deletions
Download patch file Download diff file Expand all files Collapse all files

48
defects/argo-cd/patch/argo-cd-0001-merge-ignore-diff-dedup-on2.patch Normal file
View file

@ -0,0 +1,48 @@
# UNDF: UNDF-2026-000000760
# UNDF: (leave blank)
--- a/util/argo/diff/ignore.go
+++ b/util/argo/diff/ignore.go
@@ -89,18 +89,36 @@ func resourceToIgnoreDifference(resource v1alpha1.ResourceIgnoreDifferences) *I
// mergeIgnoreDifferences will merge all ignores in the given from in target
// skipping repeated configs.
func mergeIgnoreDifferences(from *IgnoreDifference, target *IgnoreDifference) {
- for _, jqPath := range from.JQPathExpressions {
- if !slices.Contains(target.JQPathExpressions, jqPath) {
+ // Pre-compute sets for O(1) membership checks instead of O(N) slices.Contains
+ // on the growing target slice (fixes O(P^2) → O(P) per field).
+ jqSet := make(map[string]struct{}, len(target.JQPathExpressions))
+ for _, v := range target.JQPathExpressions {
+ jqSet[v] = struct{}{}
+ }
+ jpSet := make(map[string]struct{}, len(target.JSONPointers))
+ for _, v := range target.JSONPointers {
+ jpSet[v] = struct{}{}
+ }
+ mfSet := make(map[string]struct{}, len(target.ManagedFieldsManagers))
+ for _, v := range target.ManagedFieldsManagers {
+ mfSet[v] = struct{}{}
+ }
+
+ for _, jqPath := range from.JQPathExpressions {
+ if _, exists := jqSet[jqPath]; !exists {
target.JQPathExpressions = append(target.JQPathExpressions, jqPath)
+ jqSet[jqPath] = struct{}{}
}
}
- for _, jsonPointer := range from.JSONPointers {
- if !slices.Contains(target.JSONPointers, jsonPointer) {
+ for _, jsonPointer := range from.JSONPointers {
+ if _, exists := jpSet[jsonPointer]; !exists {
target.JSONPointers = append(target.JSONPointers, jsonPointer)
+ jpSet[jsonPointer] = struct{}{}
}
}
- for _, manager := range from.ManagedFieldsManagers {
- if !slices.Contains(target.ManagedFieldsManagers, manager) {
+ for _, manager := range from.ManagedFieldsManagers {
+ if _, exists := mfSet[manager]; !exists {
target.ManagedFieldsManagers = append(target.ManagedFieldsManagers, manager)
+ mfSet[manager] = struct{}{}
}
}
}