engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Browse source 
Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K
This commit is contained in:
russell@unturf.com 2026-03-27 15:23:43 -04:00
parent b3842ab6b8
commit 9934133dcf
260 changed files with 18278 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

110
defects/cassandra/unit/CassandraTest.java Normal file
View file

@ -0,0 +1,110 @@
package unit;
import java.util.*;
/**
* Cassandra CWE-407 unit tests — standalone, no JUnit.
*
* cassandra-0001 DEAD_STATES/SILENT_SHUTDOWN_STATES List.contains() per endpoint
* src/java/org/apache/cassandra/gms/Gossiper.java:147,1334,1343
*/
public class CassandraTest {
// -----------------------------------------------------------------------
// cassandra-0001: isDeadState() — List.contains() vs Set.contains()
//
// Models the per-gossip-tick loop: for each of N endpoints, check whether
// the endpoint's status string is in the dead-states collection.
// Slow: List (ArrayList / Arrays.asList) — O(|states|) per lookup.
// Fast: HashSet — O(1) per lookup.
// -----------------------------------------------------------------------
static final String[] STATUS_STRINGS = {
"REMOVING_TOKEN", "REMOVED_TOKEN", "STATUS_LEFT", "HIBERNATE",
"NORMAL", "BOOTSTRAPPING", "JOINING", "LEAVING"
};
static final String[] DEAD_STATES_ARR = {
"REMOVING_TOKEN", "REMOVED_TOKEN", "STATUS_LEFT", "HIBERNATE"
};
/**
* Slow: DEAD_STATES is an ArrayList; membership test is O(|DEAD_STATES|).
* Called once per endpoint per gossip round.
* Returns total comparison operations performed.
*/
static long deadStateSlowOps(int numEndpoints) {
List<String> deadStates = new ArrayList<>(Arrays.asList(DEAD_STATES_ARR));
// Simulate SILENT_SHUTDOWN_STATES built as ArrayList too
List<String> silentStates = new ArrayList<>(deadStates);
long ops = 0;
Random rng = new Random(42);
for (int ep = 0; ep < numEndpoints; ep++) {
// Each endpoint has a status — pick one at random
String status = STATUS_STRINGS[rng.nextInt(STATUS_STRINGS.length)];
// isDeadState: scan deadStates list
for (int i = 0; i < deadStates.size(); i++) {
ops++;
if (deadStates.get(i).equals(status)) break;
}
// isSilentShutdownState: scan silentStates list
for (int i = 0; i < silentStates.size(); i++) {
ops++;
if (silentStates.get(i).equals(status)) break;
}
}
return ops;
}
/**
* Fast: DEAD_STATES and SILENT_SHUTDOWN_STATES are HashSet; O(1) lookup.
* Returns total comparison operations performed (one per endpoint per check).
*/
static long deadStateFastOps(int numEndpoints) {
Set<String> deadStates = new HashSet<>(Arrays.asList(DEAD_STATES_ARR));
Set<String> silentStates = new HashSet<>(deadStates);
long ops = 0;
Random rng = new Random(42);
for (int ep = 0; ep < numEndpoints; ep++) {
String status = STATUS_STRINGS[rng.nextInt(STATUS_STRINGS.length)];
// isDeadState: O(1) hash lookup — count as 1 op
ops++;
deadStates.contains(status);
// isSilentShutdownState: O(1) hash lookup — count as 1 op
ops++;
silentStates.contains(status);
}
return ops;
}
// -----------------------------------------------------------------------
// Test runner
// -----------------------------------------------------------------------
public static void main(String[] args) {
int passed = 0;
int failed = 0;
// cassandra-0001 at various cluster sizes
int[] sizes = {100, 500, 1000, 2000};
for (int n : sizes) {
long slow = deadStateSlowOps(n);
long fast = deadStateFastOps(n);
// Slow should be > 2x fast: List scan vs O(1) set
// At minimum 2x because DEAD_STATES has 4 entries and ~half statuses
// won't be found until partway through the list.
boolean pass = slow > fast * 2;
System.out.printf("cassandra-0001 N=%-5d slow=%6d fast=%6d ratio=%.1fx %s%n",
n, slow, fast, (double) slow / fast, pass ? "PASS" : "FAIL");
if (pass) passed++; else failed++;
}
System.out.printf("%nTotal: %d/%d PASS%n", passed, passed + failed);
if (failed > 0) System.exit(1);
}
}