cockroach/influxdb: CWE-407 findings

defects/cockroach/patch/cockroach-0001-indexes-used-add-quadratic.patch

@@ -0,0 +1,38 @@
+# UNDF:
+--- a/pkg/sql/opt/exec/execbuilder/builder.go
++++ b/pkg/sql/opt/exec/execbuilder/builder.go
+@@ -7,7 +7,6 @@ package execbuilder
+ import (
+ 	"context"
+-	"slices"
+ 	"strconv"
+ 	"time"
+
+@@ -197,14 +197,20 @@ type IndexesUsed struct {
+ 	indexes []struct {
+ 		tableID cat.StableID
+ 		indexID cat.StableID
+ 	}
++	seen map[[2]cat.StableID]struct{}
+ }
+
+ // add adds the given index to the list, if it is not already present.
+ func (iu *IndexesUsed) add(tableID, indexID cat.StableID) {
+-	s := struct {
+-		tableID cat.StableID
+-		indexID cat.StableID
+-	}{tableID, indexID}
+-	if !slices.Contains(iu.indexes, s) {
+-		iu.indexes = append(iu.indexes, s)
++	key := [2]cat.StableID{tableID, indexID}
++	if iu.seen == nil {
++		iu.seen = make(map[[2]cat.StableID]struct{})
++	}
++	if _, ok := iu.seen[key]; !ok {
++		iu.seen[key] = struct{}{}
++		iu.indexes = append(iu.indexes, struct {
++			tableID cat.StableID
++			indexID cat.StableID
++		}{tableID, indexID})
+ 	}
+ }

defects/cockroach/patch/cockroach-0002-fingerprint-ignored-columns-quadratic.patch

@@ -0,0 +1,34 @@
+# UNDF:
+--- a/pkg/sql/show_fingerprints.go
++++ b/pkg/sql/show_fingerprints.go
+@@ -432,13 +432,17 @@ func BuildExperimentalFingerprintQueryForIndex(
+ 	tableDesc catalog.TableDescriptor, index catalog.Index, ignoredColumns []string,
+ ) (string, error) {
++	ignored := make(map[string]struct{}, len(ignoredColumns))
++	for _, c := range ignoredColumns {
++		ignored[c] = struct{}{}
++	}
+ 	cols := make([]string, 0, len(tableDesc.PublicColumns()))
+ 	var numBytesCols int
+ 	addColumn := func(col catalog.Column) {
+-		if slices.Contains(ignoredColumns, col.GetName()) {
++		if _, skip := ignored[col.GetName()]; skip {
+ 			return
+ 		}
+ 		// rest unchanged
+@@ -502,12 +506,16 @@ func BuildFingerprintQueryForIndex(
+ 	tableDesc catalog.TableDescriptor, index catalog.Index, ignoredColumns []string,
+ ) (string, error) {
++	ignored := make(map[string]struct{}, len(ignoredColumns))
++	for _, c := range ignoredColumns {
++		ignored[c] = struct{}{}
++	}
+ 	cols := make([]string, 0, len(tableDesc.PublicColumns()))
+ 	addColumn := func(col catalog.Column) {
+-		if slices.Contains(ignoredColumns, col.GetName()) {
++		if _, skip := ignored[col.GetName()]; skip {
+ 			return
+ 		}
+
+ 		cols = append(cols, makeColumnNameOrExpr(col))
+ 	}

defects/cockroach/patch/cockroach-0003-ensure-roles-quadratic.patch

@@ -0,0 +1,20 @@
+# UNDF:
+--- a/pkg/sql/authorization.go
++++ b/pkg/sql/authorization.go
+@@ -564,10 +564,14 @@ func EnsureUserOnlyBelongsToRoles(
+ 		// Compute the differences between the current roles and the desired roles
+ 		// to determine which roles need to granted or revoked.
+ 		rolesToRevoke := make([]username.SQLUsername, 0, len(currentRoles))
+ 		rolesToGrant := make([]username.SQLUsername, 0, len(roles))
++		// Build a set for O(1) membership tests instead of O(D) slices.Contains.
++		desiredSet := make(map[username.SQLUsername]struct{}, len(roles))
++		for _, r := range roles {
++			desiredSet[r] = struct{}{}
++		}
+ 		for role := range currentRoles {
+-			if !slices.Contains(roles, role) {
++			if _, ok := desiredSet[role]; !ok {
+ 				rolesToRevoke = append(rolesToRevoke, role)
+ 			}
+ 		}
+ 		for _, role := range roles {