whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K

defects/prometheus/patch/prometheus-0001.patch

@@ -0,0 +1,61 @@
+--- a/model/labels/labels_slicelabels.go
++++ b/model/labels/labels_slicelabels.go
+@@ -415,14 +415,22 @@ func NewBuilder(base Labels) *Builder {
+ // Labels returns the labels from the builder.
+ // If no modifications were made, the original labels are returned.
+ func (b *Builder) Labels() Labels {
+ 	if len(b.del) == 0 && len(b.add) == 0 {
+ 		return b.base
+ 	}
+
++	// Build O(1) lookup sets once rather than calling slices.Contains (O(D)) and
++	// contains (O(A)) inside the O(L) base loop — avoids O(L×D) and O(L×A).
++	delSet := make(map[string]struct{}, len(b.del))
++	for _, n := range b.del {
++		delSet[n] = struct{}{}
++	}
++	addSet := make(map[string]struct{}, len(b.add))
++	for _, a := range b.add {
++		addSet[a.Name] = struct{}{}
++	}
++
+ 	expectedSize := max(len(b.base)+len(b.add)-len(b.del), 1)
+ 	res := make(Labels, 0, expectedSize)
+ 	for _, l := range b.base {
+-		if slices.Contains(b.del, l.Name) || contains(b.add, l.Name) {
++		if _, inDel := delSet[l.Name]; inDel {
++			continue
++		}
++		if _, inAdd := addSet[l.Name]; inAdd {
+ 			continue
+ 		}
+ 		res = append(res, l)
+--- a/model/labels/labels_common.go
++++ b/model/labels/labels_common.go
+@@ -204,12 +204,16 @@ func (b *Builder) Set(n, v string) *Builder {
+ // Get returns the current value of label n from the builder. It checks the
+ // pending-add slice first, then falls back to the base label set.
+ func (b *Builder) Get(n string) string {
+-	// Del() removes entries from .add but Set() does not remove from .del, so check .add first.
+-	for _, a := range b.add {
+-		if a.Name == n {
+-			return a.Value
+-		}
++	// Del() removes entries from .add but Set() does not remove from .del, so
++	// check .add first.  Linear scan over b.add is acceptable: the add slice is
++	// bounded to the number of labels set in a single relabel rule (typically ≤5).
++	// For callers that repeatedly call Get on a large add slice, build a map once.
++	for i := range b.add {
++		if b.add[i].Name == n {
++			return b.add[i].Value
+ 		}
+-	if slices.Contains(b.del, n) {
+-		return ""
+ 	}
++	for _, d := range b.del {
++		if d == n {
++			return ""
++		}
++	}
+ 	return b.base.Get(n)
+ }

defects/prometheus/unit/PrometheusTest.java

@@ -0,0 +1,95 @@
+package unit;
+
+import java.util.*;
+
+/**
+ * Standalone unit test for prometheus-0001: CWE-407.
+ *
+ * prometheus-0001: Builder.Labels() del-slice membership — O(n²)
+ *   slow() uses a List<String> for the "deleted" set; contains() is O(D).
+ *         For each of L base labels: O(D) del-check + O(A) add-check → O(L×(D+A)).
+ *   fast() uses a HashSet<String> for both del and add; contains() is O(1).
+ *         For each of L base labels: O(1) del-check + O(1) add-check → O(L).
+ *   Assert: slowOps > fastOps * 10x for L=500 labels with D=250 deleted.
+ */
+public class PrometheusTest {
+
+    /**
+     * Slow path — Builder.Labels() with []string del-set: O(L * D) membership tests.
+     */
+    static long slowBuilderLabels(List<String> base, List<String> del, List<String> add) {
+        long ops = 0;
+        List<String> result = new ArrayList<>(base.size());
+        for (String label : base) {
+            // slices.Contains(del, label) — O(D) linear scan
+            boolean inDel = false;
+            for (String d : del) {
+                ops++;
+                if (d.equals(label)) { inDel = true; break; }
+            }
+            if (inDel) continue;
+
+            // contains(add, label) — O(A) linear scan
+            boolean inAdd = false;
+            for (String a : add) {
+                ops++;
+                if (a.equals(label)) { inAdd = true; break; }
+            }
+            if (inAdd) continue;
+
+            result.add(label);
+        }
+        return ops;
+    }
+
+    /**
+     * Fast path — Builder.Labels() with map-based del/add sets: O(L) total.
+     */
+    static long fastBuilderLabels(List<String> base, List<String> del, List<String> add) {
+        long ops = 0;
+        // Build O(1) sets — cost O(D + A)
+        Set<String> delSet = new HashSet<>(del);
+        for (String ignored : del) ops++;
+        Set<String> addSet = new HashSet<>(add);
+        for (String ignored : add) ops++;
+
+        List<String> result = new ArrayList<>(base.size());
+        for (String label : base) {
+            ops++; // single O(1) hash lookup
+            if (delSet.contains(label)) continue;
+            ops++;
+            if (addSet.contains(label)) continue;
+            result.add(label);
+        }
+        return ops;
+    }
+
+    static void testBuilderLabels() {
+        int L = 500;   // base label count
+        int D = 250;   // deleted label count (worst case: half of base)
+        int A = 50;    // added label count
+
+        List<String> base = new ArrayList<>(L);
+        for (int i = 0; i < L; i++) base.add("label_" + i);
+
+        List<String> del = new ArrayList<>(D);
+        for (int i = 0; i < D; i++) del.add("label_" + i);  // delete first D
+
+        List<String> add = new ArrayList<>(A);
+        for (int i = 0; i < A; i++) add.add("new_label_" + i);
+
+        long sOps = slowBuilderLabels(base, del, add);
+        long fOps = fastBuilderLabels(base, del, add);
+
+        int Nx = 10;
+        boolean pass = sOps > fOps * Nx;
+        System.out.printf("prometheus-0001 [L=%d D=%d A=%d]: slow=%d fast=%d ratio=%.1fx — %s%n",
+                L, D, A, sOps, fOps, (double) sOps / fOps, pass ? "PASS" : "FAIL");
+        if (!pass) throw new AssertionError("prometheus-0001 FAIL: slow=" + sOps + " fast=" + fOps);
+    }
+
+    public static void main(String[] args) {
+        testBuilderLabels();
+        System.out.println("1/1 PASS");
+    }
+}