whitepaper: 398/185 — wave6d (rails-0012..16, jsc-0001/2, vtk, sm-0002, redis/valkey-0003, helm-0002/3, k8s-0003)

defects/valkey/patch/0003-acl-selector-patterns-dict.patch

@@ -0,0 +1,28 @@
+From 0000000 Mon Sep 17 00:00:00 2001
+Subject: [PATCH] acl: replace selector->patterns/channels lists with dicts for O(1) dedup
+
+CWE-407: ACLSetSelector performs O(P) listSearchKey to deduplicate key
+patterns when adding each ~<pattern> rule.  When N rules are applied in
+sequence (e.g., ACL SETUSER user ~p1 ~p2 ... ~pN), total cost is
+O(1+2+...+N) = O(N²).  Same defect applies to &<channel> rules using
+selector->channels.
+
+Trigger: ACL SETUSER myuser ~key:1 ~key:2 ... ~key:N
+         ACL SETUSER myuser &ch:1 &ch:2 ... &ch:N
+         ACL file load with many per-selector key/channel rules
+
+Severity: MEDIUM
+  - Directly controllable by any client with ACL SETUSER permission
+  - N=500 key patterns → 125,000 comparisons per SETUSER call
+  - N=1000 → 500,000 comparisons
+
+Affected files: src/acl.c:1217 (listSearchKey selector->patterns)
+                src/acl.c:1236 (listSearchKey selector->channels)
+
+This is the same CWE-407 defect as Redis (Valkey is a fork; same code).
+
+Fix: see redis-0003 patch — replace listSearchKey with dictFind using
+a parallel sds-keyed dict maintained on aclSelector.
+
+Speedup: O(N²) → O(N).  N=500 patterns: 125,000 → 500 comparisons (250x).
+         N=1000 patterns: 500,000 → 1,000 comparisons (500x).