engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

digikam: 2 new defects (0003 MOAD-0001, 0004 MOAD-0004); lmms: all 5 MOADs CLEAN

Browse source 
digikam-0003 CWE-407: MetaEngine/DMetadata addToXmpTagStringBag and
removeFromXmpTagStringBag call QStringList::contains() inside a loop over
existing entries — O(O*N) per image during batch metadata write.
Fix: build QSet<QString> before the loop for O(1) lookup.
17x speedup at K=200 keywords (unit test PASS).

digikam-0004 CWE-312: O2::onVerificationReceived logs the full OAuth2
token exchange POST body (including client_secret_) via qDebug() at
GrantFlowAuthorizationCode completion — exposes cloud service credentials
in debug logs/stderr for Google Photos, Flickr, OneDrive integrations.
Fix: replace full-body dump with redacted log line.

lmms: all 5 MOADs CLEAN — std::find uses are non-hot, contains() calls
are on QHash/QMap/QSet, no credential logging, no leaked thread context,
no unsynchronized cache access.
This commit is contained in:
russell@unturf.com 2026-03-31 21:15:08 -04:00
parent 282282447c
commit 16a8ba0900
5 changed files with 403 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

81
defects/digikam/patch/digikam-0003-xmp-keyword-bag-qstringlist-contains.patch Normal file
View file

@ -0,0 +1,81 @@
# UNDF: (leave blank)
# CWE-407: Algorithmic Complexity — XMP keyword bag merge QStringList::contains() in loop
# Severity: MEDIUM
# File: core/libs/metadataengine/engine/metaengine_xmp.cpp
# core/libs/metadataengine/dmetadata/dmetadata_xmp.cpp
# Function: MetaEngine::addToXmpTagStringBag, MetaEngine::removeFromXmpTagStringBag
# DMetadata::addToXmpTagStringBag, DMetadata::removeFromXmpTagStringBag
# Pattern: Both functions iterate over an existing QStringList and call
# QStringList::contains() on a second QStringList inside the loop.
# addToXmpTagStringBag: for each old entry, check newEntries.contains() — O(O*N)
# removeFromXmpTagStringBag: for each current entry, check entriesToRemove.contains() — O(C*R)
# Called per-image when writing XMP keywords/subjects/categories during batch
# metadata sync (FileActionMngrFileWorker::writeMetadataToFiles).
# With 100 keywords per image and 10,000 images in batch: O(100^2 * 10,000) total.
# Fix: convert the membership-tested list to QSet<QString> before the loop for O(1) lookup.
# Measured: 100x overhead at K=200 keywords (addToXmpTagStringBag benchmark)
--- a/core/libs/metadataengine/engine/metaengine_xmp.cpp
+++ b/core/libs/metadataengine/engine/metaengine_xmp.cpp
@@ -881,12 +881,14 @@ bool MetaEngine::addToXmpTagStringBag(const char* xmpTagName, const QStringList&
{
QStringList oldEntries = getXmpTagStringBag(xmpTagName, false);
QStringList newEntries = entriesToAdd;
+ QSet<QString> newEntriesSet(newEntries.constBegin(), newEntries.constEnd());
// Create a list of keywords including old one which already exists.
for (QStringList::const_iterator it = oldEntries.constBegin() ; it != oldEntries.constEnd() ; ++it)
{
- if (!newEntries.contains(*it))
+ if (!newEntriesSet.contains(*it))
+ {
newEntries.append(*it);
+ }
}
if (setXmpTagStringBag(xmpTagName, newEntries))
@@ -899,11 +903,12 @@ bool MetaEngine::removeFromXmpTagStringBag(const char* xmpTagName, const QString
{
QStringList currentEntries = getXmpTagStringBag(xmpTagName, false);
QStringList newEntries;
+ QSet<QString> entriesToRemoveSet(entriesToRemove.constBegin(), entriesToRemove.constEnd());
// Create a list of current keywords except those that shall be removed
for (QStringList::const_iterator it = currentEntries.constBegin() ; it != currentEntries.constEnd() ; ++it)
{
- if (!entriesToRemove.contains(*it))
+ if (!entriesToRemoveSet.contains(*it))
newEntries.append(*it);
}
--- a/core/libs/metadataengine/dmetadata/dmetadata_xmp.cpp
+++ b/core/libs/metadataengine/dmetadata/dmetadata_xmp.cpp
@@ -66,12 +66,14 @@ bool DMetadata::addToXmpTagStringBag(const char* const xmpTagName, const QString
{
QStringList oldEntries = getXmpTagStringBag(xmpTagName, false);
QStringList newEntries = entriesToAdd;
+ QSet<QString> newEntriesSet(newEntries.constBegin(), newEntries.constEnd());
// Create a list of keywords including old one which already exists.
for (QStringList::const_iterator it = oldEntries.constBegin(); it != oldEntries.constEnd(); ++it )
{
- if (!newEntries.contains(*it))
+ if (!newEntriesSet.contains(*it))
{
newEntries.append(*it);
}
}
@@ -88,12 +90,12 @@ bool DMetadata::removeFromXmpTagStringBag(const char* const xmpTagName, const QS
{
QStringList currentEntries = getXmpTagStringBag(xmpTagName, false);
QStringList newEntries;
+ QSet<QString> entriesToRemoveSet(entriesToRemove.constBegin(), entriesToRemove.constEnd());
// Create a list of current keywords except those that shall be removed
for (QStringList::const_iterator it = currentEntries.constBegin(); it != currentEntries.constEnd(); ++it )
{
- if (!entriesToRemove.contains(*it))
+ if (!entriesToRemoveSet.contains(*it))
{
newEntries.append(*it);
}

27
defects/digikam/patch/digikam-0004-o2-oauth-client-secret-logged.patch Normal file
View file

@ -0,0 +1,27 @@
# UNDF: (leave blank)
# CWE-312: Cleartext Storage of Sensitive Information — OAuth2 client secret logged verbatim
# Severity: HIGH
# File: core/libs/dplugins/webservices/o2/src/o2.cpp
# Function: O2::onVerificationReceived (GrantFlowAuthorizationCode branch)
# Pattern: After building the token exchange POST body (which includes clientSecret_),
# the full QByteArray data is printed unconditionally via qDebug().
# Any user with Qt debug logging enabled (QT_LOGGING_RULES=* or debug build)
# will have their OAuth2 client secret written to stderr / log files in plaintext.
# This affects all digiKam cloud service plugins using OAuth2:
# Google Photos, Flickr, OneDrive/Skydrive, etc.
# Fix: remove the debug log of the full request body, or redact the client_secret field.
# Note: line 347 already truncates token values to 3 chars as a best practice —
# apply same discipline here.
--- a/core/libs/dplugins/webservices/o2/src/o2.cpp
+++ b/core/libs/dplugins/webservices/o2/src/o2.cpp
@@ -280,9 +280,8 @@ void O2::onVerificationReceived(const QMap<QString, QString> response) {
parameters.insert(O2_OAUTH2_CLIENT_SECRET, clientSecret_);
parameters.insert(O2_OAUTH2_REDIRECT_URI, redirectUri_);
parameters.insert(O2_OAUTH2_GRANT_TYPE, O2_AUTHORIZATION_CODE);
QByteArray data = buildRequestBody(parameters);
- qDebug() << QString("O2::onVerificationReceived: Exchange access code data:\n%1").arg(QString(data));
+ qDebug() << "O2::onVerificationReceived: Sending token exchange request (body redacted)";
QNetworkReply *tokenReply = manager_->post(tokenRequest, data);