engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Browse source 
Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K
This commit is contained in:
russell@unturf.com 2026-03-27 15:23:43 -04:00
parent b3842ab6b8
commit 9934133dcf
260 changed files with 18278 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

130
defects/envoy/unit/EnvoyTest.java Normal file
View file

@ -0,0 +1,130 @@
package unit;
import java.util.*;
/**
* EnvoyTest — CWE-407 benchmark for envoy-0001
*
* envoy-0001: PreviousHostsRetryPredicate shouldSelectAnotherHost()
* SLOW: std::find on std::vector<HostDescription*> — O(attempted) per call
* FAST: absl::flat_hash_set::contains — O(1) per call
*
* Model: R retry attempts, each calling shouldSelectAnotherHost once.
* After each attempt, onHostAttempted adds the host to the collection.
* Total ops slow: 0 + 1 + 2 + ... + (R-1) = R*(R-1)/2 → O(R²)
* Total ops fast: R × 1 = R → O(R)
*/
public class EnvoyTest {
// -------------------------------------------------------------------------
// Simulated host type — identity by object reference (pointer in C++)
// -------------------------------------------------------------------------
static class Host {
final int id;
Host(int id) { this.id = id; }
}
// -------------------------------------------------------------------------
// SLOW: vector + linear find
// -------------------------------------------------------------------------
static long retryPredicate_slow(Host[] candidateHosts, int maxAttempts) {
List<Host> attemptedHosts = new ArrayList<>();
long ops = 0;
for (int attempt = 0; attempt < maxAttempts && attempt < candidateHosts.length; attempt++) {
Host candidate = candidateHosts[attempt];
// shouldSelectAnotherHost: O(attempted) scan
for (Host h : attemptedHosts) {
ops++;
if (h == candidate) break;
}
// onHostAttempted
attemptedHosts.add(candidate);
}
return ops;
}
// -------------------------------------------------------------------------
// FAST: hash set + O(1) contains
// -------------------------------------------------------------------------
static long retryPredicate_fast(Host[] candidateHosts, int maxAttempts) {
Set<Host> attemptedHosts = new HashSet<>();
long ops = 0;
for (int attempt = 0; attempt < maxAttempts && attempt < candidateHosts.length; attempt++) {
Host candidate = candidateHosts[attempt];
// shouldSelectAnotherHost: O(1) hash lookup — count as 1 op
ops++;
attemptedHosts.contains(candidate);
// onHostAttempted
attemptedHosts.add(candidate);
}
return ops;
}
// -------------------------------------------------------------------------
// Helpers
// -------------------------------------------------------------------------
static Host[] makeHosts(int n) {
Host[] hosts = new Host[n];
for (int i = 0; i < n; i++) hosts[i] = new Host(i);
return hosts;
}
static void bench(String label, long sOps, long fOps) {
System.out.printf(" %-50s slow=%7d fast=%5d ratio=%5.1fx%n",
label, sOps, fOps, (double) sOps / Math.max(fOps, 1));
}
// -------------------------------------------------------------------------
// Main
// -------------------------------------------------------------------------
public static void main(String[] args) {
System.out.println("EnvoyTest — CWE-407 envoy-0001 retry predicate linear scan");
System.out.println();
// --- R=50 retries, H=50 candidate hosts ---
{
int R = 50;
Host[] hosts = makeHosts(R);
long sOps = retryPredicate_slow(hosts, R);
long fOps = retryPredicate_fast(hosts, R);
bench("retry R=50 (each host attempted once)", sOps, fOps);
assert sOps > fOps * 10 :
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
}
// --- R=100 retries ---
{
int R = 100;
Host[] hosts = makeHosts(R);
long sOps = retryPredicate_slow(hosts, R);
long fOps = retryPredicate_fast(hosts, R);
bench("retry R=100", sOps, fOps);
assert sOps > fOps * 25 :
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
}
// --- R=200 retries (large cluster, high retry budget) ---
{
int R = 200;
Host[] hosts = makeHosts(R);
long sOps = retryPredicate_slow(hosts, R);
long fOps = retryPredicate_fast(hosts, R);
bench("retry R=200", sOps, fOps);
assert sOps > fOps * 50 :
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
}
// --- R=500 retries (stress: Envoy max_attempts=500) ---
{
int R = 500;
Host[] hosts = makeHosts(R);
long sOps = retryPredicate_slow(hosts, R);
long fOps = retryPredicate_fast(hosts, R);
bench("retry R=500 (stress)", sOps, fOps);
assert sOps > fOps * 100 :
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
}
System.out.println();
System.out.println("All assertions passed.");
}
}