engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Browse source 
Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K
This commit is contained in:
russell@unturf.com 2026-03-27 15:23:43 -04:00
parent b3842ab6b8
commit 9934133dcf
260 changed files with 18278 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

171
defects/istio/unit/IstioTest.java Normal file
View file

@ -0,0 +1,171 @@
package unit;
import java.util.*;
/**
* IstioTest — CWE-407 benchmark for istio-0001
*
* istio-0001: virtualHostMatch slices.Contains(vh.Domains, domainName)
* called inside VirtualHost × patch nested loop → O(VH × P × D)
*
* Model:
* VH = number of VirtualHosts in a route config
* P = number of EnvoyFilter patches
* D = number of domain aliases per VirtualHost
*
* SLOW: for each VH, for each patch, slices.Contains(vh.domains) → O(VH × P × D)
* FAST: build domain→VH map once, O(VH×D) setup, then O(VH×P) matching → O(VH×P)
*/
public class IstioTest {
// -------------------------------------------------------------------------
// Data model
// -------------------------------------------------------------------------
static class VirtualHost {
final String name;
final List<String> domains;
VirtualHost(String name, int domainCount) {
this.name = name;
this.domains = new ArrayList<>(domainCount);
// e.g. "svc.ns.svc.cluster.local", "svc.ns", "svc", "svc:80", ...
for (int i = 0; i < domainCount; i++) {
domains.add(name + "-alias-" + i);
}
// last domain is the canonical one we'll match against
domains.add(name + ".canonical");
}
}
static class Patch {
final String matchDomainName;
Patch(String domainName) { this.matchDomainName = domainName; }
}
// -------------------------------------------------------------------------
// SLOW: slices.Contains per virtualHostMatch call
// -------------------------------------------------------------------------
static long patchRouteConfig_slow(List<VirtualHost> virtualHosts, List<Patch> patches) {
long ops = 0;
for (VirtualHost vh : virtualHosts) {
for (Patch p : patches) {
// virtualHostMatch: slices.Contains(vh.domains, p.matchDomainName)
if (!p.matchDomainName.isEmpty()) {
for (String d : vh.domains) {
ops++;
if (d.equals(p.matchDomainName)) break;
}
}
}
}
return ops;
}
// -------------------------------------------------------------------------
// FAST: domain→VH map built once before the loop
// -------------------------------------------------------------------------
static long patchRouteConfig_fast(List<VirtualHost> virtualHosts, List<Patch> patches) {
long ops = 0;
// Build index: O(VH × D) — counted once
Map<String, VirtualHost> domainIndex = new HashMap<>();
for (VirtualHost vh : virtualHosts) {
for (String d : vh.domains) {
ops++;
domainIndex.put(d, vh);
}
}
// Now matching: O(1) per lookup
for (VirtualHost vh : virtualHosts) {
for (Patch p : patches) {
if (!p.matchDomainName.isEmpty()) {
ops++; // map.get — O(1)
domainIndex.get(p.matchDomainName);
}
}
}
return ops;
}
// -------------------------------------------------------------------------
// Helpers
// -------------------------------------------------------------------------
static List<VirtualHost> makeVirtualHosts(int count, int domainsEach) {
List<VirtualHost> list = new ArrayList<>(count);
for (int i = 0; i < count; i++) {
list.add(new VirtualHost("svc-" + i, domainsEach));
}
return list;
}
static List<Patch> makePatches(int count, List<VirtualHost> vhs) {
List<Patch> patches = new ArrayList<>(count);
for (int i = 0; i < count; i++) {
// each patch targets the canonical domain of some VH
String target = vhs.get(i % vhs.size()).name + ".canonical";
patches.add(new Patch(target));
}
return patches;
}
static void bench(String label, long sOps, long fOps) {
System.out.printf(" %-55s slow=%9d fast=%7d ratio=%5.1fx%n",
label, sOps, fOps, (double) sOps / Math.max(fOps, 1));
}
// -------------------------------------------------------------------------
// Main
// -------------------------------------------------------------------------
public static void main(String[] args) {
System.out.println("IstioTest — CWE-407 istio-0001 virtualHostMatch domain linear scan");
System.out.println();
// --- VH=100, P=5, D=10 ---
{
int VH = 100, P = 5, D = 10;
List<VirtualHost> vhs = makeVirtualHosts(VH, D);
List<Patch> patches = makePatches(P, vhs);
long sOps = patchRouteConfig_slow(vhs, patches);
long fOps = patchRouteConfig_fast(vhs, patches);
bench("VH=100 P=5 D=10", sOps, fOps);
assert sOps > fOps * 2 :
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
}
// --- VH=500, P=20, D=15 ---
{
int VH = 500, P = 20, D = 15;
List<VirtualHost> vhs = makeVirtualHosts(VH, D);
List<Patch> patches = makePatches(P, vhs);
long sOps = patchRouteConfig_slow(vhs, patches);
long fOps = patchRouteConfig_fast(vhs, patches);
bench("VH=500 P=20 D=15", sOps, fOps);
assert sOps > fOps * 5 :
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
}
// --- VH=1000, P=50, D=20 (large mesh) ---
{
int VH = 1000, P = 50, D = 20;
List<VirtualHost> vhs = makeVirtualHosts(VH, D);
List<Patch> patches = makePatches(P, vhs);
long sOps = patchRouteConfig_slow(vhs, patches);
long fOps = patchRouteConfig_fast(vhs, patches);
bench("VH=1000 P=50 D=20 (large mesh)", sOps, fOps);
assert sOps > fOps * 10 :
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
}
// --- VH=2000, P=100, D=25 (stress) ---
{
int VH = 2000, P = 100, D = 25;
List<VirtualHost> vhs = makeVirtualHosts(VH, D);
List<Patch> patches = makePatches(P, vhs);
long sOps = patchRouteConfig_slow(vhs, patches);
long fOps = patchRouteConfig_fast(vhs, patches);
bench("VH=2000 P=100 D=25 (stress)", sOps, fOps);
assert sOps > fOps * 10 :
"Expected slow >> fast, got slow=" + sOps + " fast=" + fOps;
}
System.out.println();
System.out.println("All assertions passed.");
}
}