bottle/flask/pyramid/sfml/angelscript/threejs/pygame: 22 defects + whitepaper 121 sites 50 ecosystems

defects/bottle/patch/bottle-0001-skiplist-set.patch

@@ -0,0 +1,35 @@
+Fixes bottle-0001: Route.all_plugins() — skiplist is a list, scanned 4× per plugin iteration.
+
+--- a/bottle.py
++++ b/bottle.py
+
+@@ DEFECT bottle-0001: Route.__init__() line 490 + Route.all_plugins() lines 516-519
+
+ class Route(object):
+     def __init__(self, app, rule, method, callback,
+                  name=None, plugins=None, skiplist=None, **config):
+         ...
+-        self.skiplist = skiplist or []              # list — O(n) scans — CWE-407
++        self.skiplist = set(skiplist) if skiplist else set()  # FIX: set for O(1) lookups
+
+ def all_plugins(self):
+     """ Yield all Plugins affecting this route. """
+     unique = set()
+     for p in reversed(self.app.plugins + self.plugins):
+-        if True in self.skiplist: break             # O(n) list scan — CWE-407
++        if True in self.skiplist: break             # O(1) set lookup — fixed (True is hashable)
+         name = getattr(p, 'name', False)
+-        if name and (name in self.skiplist or name in unique): continue   # O(n) list scan × 2 — CWE-407
++        if name and (name in self.skiplist or name in unique): continue   # O(1) — fixed
+-        if p in self.skiplist or type(p) in self.skiplist: continue       # O(n) list scan × 2 — CWE-407
++        if p in self.skiplist or type(p) in self.skiplist: continue       # O(1) — fixed
+         if name: unique.add(name)
+         yield p
+
+# SUMMARY: 4 list membership tests per plugin iteration → 4 O(1) set lookups.
+# Total complexity: O((P+R) × S) → O(P+R) per route compilation.
+# Cache busting on install(): O(N³) startup with N plugins → O(N²).
+#
+# NOTE: All membership patterns are hashability-safe:
+#   True is hashable; plugin names are strings; plugin objects are hashable
+#   by identity; type() is always hashable. Set conversion is drop-in safe.