grpc-java: 3 CWE-407 defects — priority-lb list.contains O(C×P), xds-client authorities list O(A×S×T), okhttp intersect O(N×M)

defects/grpc-java/patch/grpc-java-0003-okhttp-util-intersect-nested-loop.patch

@@ -0,0 +1,37 @@
+# UNDF: UNDF-2026-000000744
+# UNDF: (leave blank)
+--- a/okhttp/third_party/okhttp/main/java/io/grpc/okhttp/internal/Util.java
++++ b/okhttp/third_party/okhttp/main/java/io/grpc/okhttp/internal/Util.java
+@@ -20,6 +20,7 @@ package io.grpc.okhttp.internal;
+ import java.lang.reflect.Array;
+ import java.nio.charset.Charset;
+ import java.util.ArrayList;
++import java.util.Arrays;
++import java.util.LinkedHashSet;
+ import java.util.Arrays;
+ import java.util.Collections;
+ import java.util.List;
+@@ -59,13 +60,16 @@ public final class Util {
+   /**
+    * Returns a list containing containing only elements found in {@code first}  and also in
+    * {@code second}. The returned elements are in the same order as in {@code first}.
++   * Previously O(|first|×|second|) nested loop; now O(|first|+|second|) via HashSet.
+    */
+   private static <T> List<T> intersect(T[] first, T[] second) {
+     List<T> result = new ArrayList<>();
+-    for (T a : first) {
+-      for (T b : second) {
+-        if (a.equals(b)) {
+-          result.add(b);
+-          break;
+-        }
+-      }
++    // Build a hash-set of second for O(1) membership test.
++    LinkedHashSet<T> secondSet = new LinkedHashSet<>(Arrays.asList(second));
++    for (T a : first) {
++      if (secondSet.contains(a)) {
++        result.add(a);
++      }
+     }
+     return result;
+   }