engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

zulip: 5-MOAD scan; 3 CWE-407 defects in user_groups list membership checks

Browse source 
zulip-0001: user_groups.py lock_subgroups_with_respect_to_supergroup group_ids_found list O(G*F) -> set O(G+F), 142x at N=1000
zulip-0002: user_groups.py update_user_group group_ids_found list O(D*F) -> set O(D+F), 76x at N=1000
zulip-0003: actions/user_groups.py update_users_in_full_members_system_group full_member_group_user_ids list O(M*F) -> set O(M+F), 55x at N=1000

Previous shallow scan marked CLEAN; deeper scan found all 3. MOAD-0002/0003/0004/0005 CLEAN.
3/3 unit tests PASS.
This commit is contained in:
russell@unturf.com 2026-04-03 13:24:38 -04:00
parent 1fb374fbc5
commit 75c7eab158
11 changed files with 421 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

11
defects/zulip-0001/patch/zulip-0001.patch Normal file
View file

@ -0,0 +1,11 @@
--- a/zerver/lib/user_groups.py
+++ b/zerver/lib/user_groups.py
@@ -378,8 +378,8 @@ def lock_subgroups_with_respect_to_supergroup(
# We expect that the passed user_group_ids each corresponds to an
# existing user group.
- group_ids_found = [group.id for group in potential_subgroups]
+ group_ids_found_set = {group.id for group in potential_subgroups}
group_ids_not_found = [
- group_id for group_id in potential_subgroup_ids if group_id not in group_ids_found
+ group_id for group_id in potential_subgroup_ids if group_id not in group_ids_found_set
]