engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Browse source 
Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K
This commit is contained in:
russell@unturf.com 2026-03-27 15:23:43 -04:00
parent b3842ab6b8
commit 9934133dcf
260 changed files with 18278 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

57
defects/helm/patch/helm-0001.patch Normal file
View file

@ -0,0 +1,57 @@
--- a/internal/chart/v3/util/dependencies.go
+++ b/internal/chart/v3/util/dependencies.go
@@ -144,18 +144,22 @@ func processDependencyEnabled(c *chart.Chart, v map[string]any, path string) err
}
var chartDependencies []*chart.Chart
- // If any dependency is not a part of Chart.yaml
- // then this should be added to chartDependencies.
- // However, if the dependency is already specified in Chart.yaml
- // we should not add it, as it would be processed from Chart.yaml anyway.
-
-Loop:
- for _, existing := range c.Dependencies() {
- for _, req := range c.Metadata.Dependencies {
- if existing.Name() == req.Name && IsCompatibleRange(req.Version, existing.Metadata.Version) {
- continue Loop
- }
+ // Index metadata deps by name for O(1) lookup — avoids O(existing × metaDeps).
+ metaDepByName := make(map[string]*chart.Dependency, len(c.Metadata.Dependencies))
+ for _, req := range c.Metadata.Dependencies {
+ if req != nil {
+ metaDepByName[req.Name] = req
}
- chartDependencies = append(chartDependencies, existing)
+ }
+ // Keep loaded charts that are NOT described in Chart.yaml (extra deps).
+ for _, existing := range c.Dependencies() {
+ if req, found := metaDepByName[existing.Name()]; found {
+ if IsCompatibleRange(req.Version, existing.Metadata.Version) {
+ continue // covered by Chart.yaml processing below
+ }
+ }
+ chartDependencies = append(chartDependencies, existing)
}
+ // Index loaded deps by name for O(1) alias resolution — avoids O(metaDeps × charts).
+ chartsByName := make(map[string]*chart.Chart, len(c.Dependencies()))
+ for _, ch := range c.Dependencies() {
+ if ch != nil {
+ chartsByName[ch.Name()] = ch
+ }
+ }
for _, req := range c.Metadata.Dependencies {
if req == nil {
continue
}
- if chartDependency := getAliasDependency(c.Dependencies(), req); chartDependency != nil {
- chartDependencies = append(chartDependencies, chartDependency)
+ // getAliasDependency still used for version-range check and alias copy;
+ // pre-built map avoids the O(charts) linear scan inside it.
+ if ch, ok := chartsByName[req.Name]; ok {
+ if chartDependency := getAliasDependency([]*chart.Chart{ch}, req); chartDependency != nil {
+ chartDependencies = append(chartDependencies, chartDependency)
+ }
}
if req.Alias != "" {
req.Name = req.Alias

120
defects/helm/unit/HelmTest.java Normal file
View file

@ -0,0 +1,120 @@
package unit;
import java.util.*;
/**
* Standalone unit test for helm CWE-407 defect.
*
* helm-0001: processDependencyEnabled — O(n²) nested dependency lookup
* Pattern A: for each existing dep, scan all metadata deps — O(E × M).
* Pattern B: getAliasDependency called per metadata dep — O(M × C).
*
* slow() counts ops for both patterns with nested loops.
* fast() counts ops using a pre-built name→entry map for O(1) lookups.
* Assert: slowOps > fastOps * 5x for D=200 dependencies.
*/
public class HelmTest {
static class ChartDep {
String name;
String version;
ChartDep(String name, String version) { this.name = name; this.version = version; }
}
/**
* Slow path — Pattern A: O(existing × metaDeps).
* Pattern B: O(metaDeps × charts) where getAliasDependency scans charts linearly.
*/
static long slowProcessDependencies(List<ChartDep> existing, List<ChartDep> metaDeps) {
long ops = 0;
// Pattern A: filter existing not in metaDeps
List<ChartDep> chartDeps = new ArrayList<>();
outer:
for (ChartDep ex : existing) {
for (ChartDep req : metaDeps) { // O(M) per existing item
ops++;
if (ex.name.equals(req.name)) {
continue outer;
}
}
chartDeps.add(ex);
}
// Pattern B: for each metaDep, scan existing (getAliasDependency linear scan)
for (ChartDep req : metaDeps) {
for (ChartDep ch : existing) { // O(C) per metaDep
ops++;
if (ch.name.equals(req.name)) {
chartDeps.add(ch); // alias copy
break;
}
}
}
return ops;
}
/**
* Fast path — build name→ChartDep maps once; O(1) lookups.
*/
static long fastProcessDependencies(List<ChartDep> existing, List<ChartDep> metaDeps) {
long ops = 0;
// Build index: O(E) + O(M)
Map<String, ChartDep> metaByName = new HashMap<>(metaDeps.size());
for (ChartDep req : metaDeps) {
ops++;
metaByName.put(req.name, req);
}
Map<String, ChartDep> chartsByName = new HashMap<>(existing.size());
for (ChartDep ch : existing) {
ops++;
chartsByName.put(ch.name, ch);
}
// Pattern A replacement — O(E) with O(1) lookup
List<ChartDep> chartDeps = new ArrayList<>();
for (ChartDep ex : existing) {
ops++;
if (!metaByName.containsKey(ex.name)) {
chartDeps.add(ex);
}
}
// Pattern B replacement — O(M) with O(1) lookup
for (ChartDep req : metaDeps) {
ops++;
ChartDep ch = chartsByName.get(req.name);
if (ch != null) {
chartDeps.add(ch);
}
}
return ops;
}
static void testProcessDependencies() {
int D = 200; // number of dependencies
List<ChartDep> existing = new ArrayList<>(D);
List<ChartDep> metaDeps = new ArrayList<>(D);
for (int i = 0; i < D; i++) {
existing.add(new ChartDep("chart-" + i, "1.0." + i));
metaDeps.add(new ChartDep("chart-" + i, ">=1.0.0"));
}
long sOps = slowProcessDependencies(existing, metaDeps);
long fOps = fastProcessDependencies(existing, metaDeps);
int Nx = 5;
boolean pass = sOps > fOps * Nx;
System.out.printf("helm-0001 [D=%d]: slow=%d fast=%d ratio=%.1fx — %s%n",
D, sOps, fOps, (double) sOps / fOps, pass ? "PASS" : "FAIL");
if (!pass) throw new AssertionError("helm-0001 FAIL: slow=" + sOps + " fast=" + fOps);
}
public static void main(String[] args) {
testProcessDependencies();
System.out.println("1/1 PASS");
}
}