engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

grpc-java: 3 CWE-407 defects — priority-lb list.contains O(C×P), xds-client authorities list O(A×S×T), okhttp intersect O(N×M)

Browse source
This commit is contained in:
russell@unturf.com 2026-03-30 08:45:32 -04:00
parent e72c6fb013
commit 2b12adc044
5 changed files with 313 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
defects/grpc-java/patch/grpc-java-0001-priority-lb-priority-names-list-contains.patch Normal file
View file

@ -0,0 +1,31 @@
# UNDF: UNDF-2026-000000742
# UNDF: (leave blank)
--- a/xds/src/main/java/io/grpc/xds/PriorityLoadBalancer.java
+++ b/xds/src/main/java/io/grpc/xds/PriorityLoadBalancer.java
@@ -65,7 +65,7 @@ final class PriorityLoadBalancer extends LoadBalancer {
private ResolvedAddresses resolvedAddresses;
// List of priority names in order.
private List<String> priorityNames;
+ private Set<String> priorityNamesSet = new HashSet<>();
// Config for each priority.
private Map<String, PriorityChildConfig> priorityConfigs;
@@ -89,6 +89,7 @@ final class PriorityLoadBalancer extends LoadBalancer {
checkNotNull(config, "missing priority lb config");
priorityNames = config.priorities;
+ priorityNamesSet = new HashSet<>(config.priorities);
priorityConfigs = config.childConfigs;
Status status = Status.OK;
- Set<String> prioritySet = new HashSet<>(config.priorities);
+ Set<String> prioritySet = priorityNamesSet;
ArrayList<String> childKeys = new ArrayList<>(children.keySet());
for (String priority : childKeys) {
if (!prioritySet.contains(priority)) {
@@ -122,7 +126,7 @@ final class PriorityLoadBalancer extends LoadBalancer {
Collection<ChildLbState> childValues = new ArrayList<>(children.values());
for (ChildLbState child : childValues) {
- if (priorityNames.contains(child.priority)) {
+ if (priorityNamesSet.contains(child.priority)) {
child.lb.handleNameResolutionError(error);
gotoTransientFailure = false;
}

19
defects/grpc-java/patch/grpc-java-0002-xds-client-get-active-authorities-list-contains.patch Normal file
View file

@ -0,0 +1,19 @@
# UNDF: UNDF-2026-000000743
# UNDF: (leave blank)
--- a/xds/src/main/java/io/grpc/xds/client/XdsClientImpl.java
+++ b/xds/src/main/java/io/grpc/xds/client/XdsClientImpl.java
@@ -1091,9 +1091,7 @@ public final class XdsClientImpl extends XdsClient {
private Collection<String> getActiveAuthorities(ControlPlaneClient cpc) {
- List<String> asList = activatedCpClients.entrySet().stream()
+ // Always return a HashSet for O(1) contains(); linear scan over asList was O(A×S×T)
+ // inside double-loops in cleanUpResourceTimers and onControlPlaneClientError.
+ return activatedCpClients.entrySet().stream()
.filter(entry -> !entry.getValue().isEmpty()
&& cpc == entry.getValue().get(entry.getValue().size() - 1))
.map(Map.Entry::getKey)
- .collect(Collectors.toList());
-
- // Since this is usually used for contains, use a set when the list is large
- return (asList.size() < 100) ? asList : new HashSet<>(asList);
+ .collect(Collectors.toCollection(HashSet::new));
}

37
defects/grpc-java/patch/grpc-java-0003-okhttp-util-intersect-nested-loop.patch Normal file
View file

@ -0,0 +1,37 @@
# UNDF: UNDF-2026-000000744
# UNDF: (leave blank)
--- a/okhttp/third_party/okhttp/main/java/io/grpc/okhttp/internal/Util.java
+++ b/okhttp/third_party/okhttp/main/java/io/grpc/okhttp/internal/Util.java
@@ -20,6 +20,7 @@ package io.grpc.okhttp.internal;
import java.lang.reflect.Array;
import java.nio.charset.Charset;
import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.LinkedHashSet;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
@@ -59,13 +60,16 @@ public final class Util {
/**
* Returns a list containing containing only elements found in {@code first} and also in
* {@code second}. The returned elements are in the same order as in {@code first}.
+ * Previously O(|first|×|second|) nested loop; now O(|first|+|second|) via HashSet.
*/
private static <T> List<T> intersect(T[] first, T[] second) {
List<T> result = new ArrayList<>();
- for (T a : first) {
- for (T b : second) {
- if (a.equals(b)) {
- result.add(b);
- break;
- }
- }
+ // Build a hash-set of second for O(1) membership test.
+ LinkedHashSet<T> secondSet = new LinkedHashSet<>(Arrays.asList(second));
+ for (T a : first) {
+ if (secondSet.contains(a)) {
+ result.add(a);
+ }
}
return result;
}