cpp-systems: tor CLEAN.md updated to note existing patches tor-0001/0002/0003

Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional
CWE-407 defects. All repos found CLEAN beyond previously recorded patches.
Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.

defects/spring/patch/spring-0001-beanfactoryutils-mergenames-list-contains.md

@@ -0,0 +1,102 @@
+# UNDF: UNDF-2026-000000295
+# UNDF: (pending)
+# spring-0001: BeanFactoryUtils.mergeNamesWithParent — O(P×R) ArrayList.contains inside loop
+
+## CWE-407 — Algorithmic Complexity: Unnecessary Quadratic Complexity (List membership inside loop)
+
+| Field | Value |
+|-------|-------|
+| ID | spring-0001 |
+| Severity | MEDIUM |
+| Ecosystem | spring-framework |
+| Package | org.springframework.beans.factory |
+| File | `spring-beans/src/main/java/org/springframework/beans/factory/BeanFactoryUtils.java` |
+| Lines | 525–532 |
+| Complexity | O(P×R) |
+| Hot path | bean type resolution with hierarchical ApplicationContext |
+
+## Defect
+
+`BeanFactoryUtils.mergeNamesWithParent()` is called by
+`beanNamesForTypeIncludingAncestors()` and related methods to merge bean name
+lists from parent and child application contexts. The `merged` variable is an
+`ArrayList<String>`. For each of the P entries in `parentResult`, the code calls
+`merged.contains(beanName)` — an O(R) linear scan where R is the number of
+already-added names. Total cost O(P×R).
+
+```java
+// BeanFactoryUtils.java line 521-532
+private static String[] mergeNamesWithParent(String[] result, String[] parentResult,
+        HierarchicalBeanFactory hbf) {
+    if (parentResult.length == 0) {
+        return result;
+    }
+    List<String> merged = new ArrayList<>(result.length + parentResult.length);
+    merged.addAll(Arrays.asList(result));
+    for (String beanName : parentResult) {
+        if (!merged.contains(beanName) && !hbf.containsLocalBean(beanName)) {
+            //      ^^^^^^^^ O(R) per iteration → O(P×R) total
+            merged.add(beanName);
+        }
+    }
+    return StringUtils.toStringArray(merged);
+}
+```
+
+This method is called from `getBeanNamesForType()`, `beanNamesForAnnotationIncludingAncestors()`,
+and similar utility methods which can be called at runtime (e.g., during dependency injection,
+AOP proxy creation, and Spring Boot auto-configuration) with deep ApplicationContext hierarchies.
+
+## Fix
+
+Use a `LinkedHashSet` to preserve insertion order while providing O(1) membership tests,
+or build a `HashSet` for the dedup check:
+
+```java
+private static String[] mergeNamesWithParent(String[] result, String[] parentResult,
+        HierarchicalBeanFactory hbf) {
+    if (parentResult.length == 0) {
+        return result;
+    }
+    Set<String> seen = new HashSet<>(Arrays.asList(result));
+    List<String> merged = new ArrayList<>(result.length + parentResult.length);
+    merged.addAll(Arrays.asList(result));
+    for (String beanName : parentResult) {
+        if (!seen.contains(beanName) && !hbf.containsLocalBean(beanName)) {
+            seen.add(beanName);
+            merged.add(beanName);
+        }
+    }
+    return StringUtils.toStringArray(merged);
+}
+```
+
+Alternatively, use `LinkedHashSet` directly:
+
+```java
+private static String[] mergeNamesWithParent(String[] result, String[] parentResult,
+        HierarchicalBeanFactory hbf) {
+    if (parentResult.length == 0) {
+        return result;
+    }
+    Set<String> merged = new LinkedHashSet<>(Arrays.asList(result));
+    for (String beanName : parentResult) {
+        if (!merged.contains(beanName) && !hbf.containsLocalBean(beanName)) {
+            merged.add(beanName);
+        }
+    }
+    return StringUtils.toStringArray(merged);
+}
+```
+
+## Speedup
+
+| R (result count) | P (parentResult count) | Before (ops) | After (ops) | Speedup |
+|-----------------|------------------------|-------------|-------------|---------|
+| 100 | 100 | 10,000 | 100 | 100× |
+| 500 | 500 | 250,000 | 500 | 500× |
+| 1,000 | 1,000 | 1,000,000 | 1,000 | 1,000× |
+
+Applications with large numbers of beans and deep ApplicationContext hierarchies
+(common in Spring Boot multi-module applications and OSGi container deployments)
+are most affected.

defects/spring/patch/spring-0002-defaultlistablebeanfactory-getnamesforannotation-list-contains.md

@@ -0,0 +1,85 @@
+# UNDF: UNDF-2026-000000317
+# UNDF: (pending)
+# spring-0002: DefaultListableBeanFactory.getBeanNamesForAnnotation — O(B×M) ArrayList.contains inside loop
+
+## CWE-407 — Algorithmic Complexity: Unnecessary Quadratic Complexity (List membership inside loop)
+
+| Field | Value |
+|-------|-------|
+| ID | spring-0002 |
+| Severity | MEDIUM |
+| Ecosystem | spring-framework |
+| Package | org.springframework.beans.factory.support |
+| File | `spring-beans/src/main/java/org/springframework/beans/factory/support/DefaultListableBeanFactory.java` |
+| Lines | 770–784 |
+| Complexity | O(B×M) |
+| Hot path | `getBeanNamesForAnnotation()` — called during startup and annotation-driven wiring |
+
+## Defect
+
+`DefaultListableBeanFactory.getBeanNamesForAnnotation()` builds a result list from
+two sources: `beanDefinitionNames` and `manualSingletonNames`. For each of the M
+entries in `manualSingletonNames` it calls `result.contains(beanName)` where `result`
+is an `ArrayList<String>` that has already been populated with up to B entries from
+`beanDefinitionNames`. This is O(B×M) — quadratic in total bean count.
+
+```java
+// DefaultListableBeanFactory.java line 770-784
+public String[] getBeanNamesForAnnotation(Class<? extends Annotation> annotationType) {
+    List<String> result = new ArrayList<>();
+    for (String beanName : this.beanDefinitionNames) {
+        BeanDefinition bd = this.beanDefinitionMap.get(beanName);
+        if (bd != null && !bd.isAbstract() && findAnnotationOnBean(beanName, annotationType) != null) {
+            result.add(beanName);
+        }
+    }
+    for (String beanName : this.manualSingletonNames) {
+        if (!result.contains(beanName) && findAnnotationOnBean(beanName, annotationType) != null) {
+            //      ^^^^^^^^ O(B) per iteration → O(B×M) total
+            result.add(beanName);
+        }
+    }
+    return StringUtils.toStringArray(result);
+}
+```
+
+`findAnnotationOnBean()` involves reflection and is itself expensive — but it is only called
+after `result.contains()` succeeds (for the negative branch), so the list scan overhead is
+paid on every iteration including those that ultimately do nothing.
+
+## Fix
+
+Build a `HashSet` shadow alongside `result` to provide O(1) dedup:
+
+```java
+public String[] getBeanNamesForAnnotation(Class<? extends Annotation> annotationType) {
+    List<String> result = new ArrayList<>();
+    Set<String> seen = new HashSet<>();
+    for (String beanName : this.beanDefinitionNames) {
+        BeanDefinition bd = this.beanDefinitionMap.get(beanName);
+        if (bd != null && !bd.isAbstract() && findAnnotationOnBean(beanName, annotationType) != null) {
+            result.add(beanName);
+            seen.add(beanName);
+        }
+    }
+    for (String beanName : this.manualSingletonNames) {
+        if (!seen.contains(beanName) && findAnnotationOnBean(beanName, annotationType) != null) {
+            result.add(beanName);
+        }
+    }
+    return StringUtils.toStringArray(result);
+}
+```
+
+## Speedup
+
+| B (bean definitions) | M (manual singletons) | Before (ops) | After (ops) | Speedup |
+|---------------------|-----------------------|-------------|-------------|---------|
+| 500 | 100 | 50,000 | 600 | 83× |
+| 1,000 | 500 | 500,000 | 1,500 | 333× |
+| 5,000 | 1,000 | 5,000,000 | 6,000 | 833× |
+
+Large Spring Boot applications with hundreds of beans annotated with `@Service`,
+`@Component`, `@Controller` etc. will benefit most. `getBeanNamesForAnnotation()`
+is called by `getBeansWithAnnotation()`, event publisher detection, and various
+Spring Boot auto-configuration processors.

defects/spring/patch/spring-0003-annotationtypemapping-processaliases-list-contains.md

@@ -0,0 +1,95 @@
+# UNDF: UNDF-2026-000000296
+# UNDF: (pending)
+# spring-0003: AnnotationTypeMapping.processAliases — O(A²×D×L) ArrayList.contains in nested annotation attribute loop
+
+## CWE-407 — Algorithmic Complexity: Unnecessary Quadratic Complexity (List membership inside nested loop)
+
+| Field | Value |
+|-------|-------|
+| ID | spring-0003 |
+| Severity | MEDIUM |
+| Ecosystem | spring-framework |
+| Package | org.springframework.core.annotation |
+| File | `spring-core/src/main/java/org/springframework/core/annotation/AnnotationTypeMapping.java` |
+| Lines | 197–258, 556–573 |
+| Complexity | O(A²×D×L) |
+| Hot path | annotation type mapping initialization (startup + first use per annotation type) |
+
+## Defect
+
+`AnnotationTypeMapping.processAliases()` resolves `@AliasFor` relationships across
+meta-annotation hierarchies. It is called once per annotation type during mapping
+construction (cached afterwards). The `aliases` local variable is an `ArrayList<Method>`.
+
+For each annotation attribute (A attributes), `processAliases(i, aliases)` is called.
+Inside that method, for each level in the meta-annotation chain (D levels), it iterates
+over all attributes (A) and calls `aliases.contains(mapping.attributes.get(i))` — an O(L)
+scan where L is the current aliases list size. The same pattern appears in
+`getFirstRootAttributeIndex()` and `MirrorSets.updateFrom()`.
+
+```java
+// processAliases(int attributeIndex, List<Method> aliases) — lines 223-248
+AnnotationTypeMapping mapping = this;
+while (mapping != null) {                         // D iterations (meta-annotation depth)
+    if (rootAttributeIndex != -1 && mapping != this.root) {
+        for (int i = 0; i < mapping.attributes.size(); i++) {  // A iterations
+            if (aliases.contains(mapping.attributes.get(i))) { // O(L) scan
+                mapping.aliasMappings[i] = rootAttributeIndex;
+            }
+        }
+    }
+    mapping.mirrorSets.updateFrom(aliases);       // updateFrom also calls aliases.contains()
+    ...
+    mapping = mapping.source;
+}
+
+// MirrorSets.updateFrom(Collection<Method> aliases) — lines 556-573
+for (int i = 0; i < attributes.size(); i++) {     // A iterations
+    Method attribute = attributes.get(i);
+    if (aliases.contains(attribute)) {             // O(L) scan
+        ...
+    }
+}
+```
+
+Total cost per annotation type: O(A × D × A × L) = O(A²×D×L).
+
+For complex composed annotations (e.g., `@SpringBootTest`, `@Transactional`, framework
+stereotypes with `@AliasFor` chains), A can be 10–30, D can be 5–10, L can be 5–10,
+yielding up to ~90,000 operations per annotation type initialization.
+
+## Fix
+
+Replace `List<Method>` with `LinkedHashSet<Method>` for `aliases` to make `.contains()`
+O(1) while preserving insertion order (order matters for alias resolution):
+
+```java
+private void processAliases() {
+    Set<Method> aliases = new LinkedHashSet<>();  // was: List<Method> aliases = new ArrayList<>();
+    for (int i = 0; i < this.attributes.size(); i++) {
+        aliases.clear();
+        aliases.add(this.attributes.get(i));
+        collectAliases(aliases);
+        if (aliases.size() > 1) {
+            processAliases(i, aliases);
+        }
+    }
+}
+```
+
+The `processAliases(int, List<Method>)` signature must also accept `Collection<Method>`
+or `Set<Method>` (or keep `List<Method>` and pass `new ArrayList<>(aliases)`).
+Similarly update `getFirstRootAttributeIndex()` and `MirrorSets.updateFrom()` parameter
+types to accept `Collection<Method>`.
+
+## Speedup
+
+| A (attributes) | D (depth) | L (alias list) | Before (ops) | After (ops) | Speedup |
+|---------------|-----------|---------------|-------------|-------------|---------|
+| 10 | 5 | 5 | 2,500 | 500 | 5× |
+| 20 | 8 | 10 | 32,000 | 4,000 | 8× |
+| 30 | 10 | 15 | 135,000 | 9,000 | 15× |
+
+Annotation types are cached after first construction, so this is a startup / first-use
+cost rather than per-request. Applications with many composed annotations (Spring Boot,
+Spring Security, Spring Data) construct many such mappings during startup.