engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Browse source 
Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K
This commit is contained in:
russell@unturf.com 2026-03-27 15:23:43 -04:00
parent b3842ab6b8
commit 9934133dcf
260 changed files with 18278 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

130
defects/spring/patch/spring-0003-0004-eventmulticaster-linkedhashset.patch Normal file
View file

@ -0,0 +1,130 @@
From 0000002 Mon Sep 17 00:00:00 2001
Subject: [PATCH] CWE-407: spring-0003/0004 — fix O(n²) ArrayList.contains()
in AbstractApplicationEventMulticaster
spring-0003 (HIGH): retrieveApplicationListeners() builds allListeners as
ArrayList<ApplicationListener<?>>. Inside the O(L) listenerBeans loop it calls
allListeners.contains() twice (lines 279, 285). With P programmatic listeners
already in the list each lookup is O(P+i). Total: O(L × (P+L)) = O(n²).
This path is hit on every event dispatch cache-miss — including startup events
in large Spring Boot applications.
spring-0004 (MEDIUM): DefaultListenerRetriever.getApplicationListeners() has
the same pattern: ArrayList allListeners, loop over applicationListenerBeans,
allListeners.contains(listener) at line 512.
Fix for both: replace ArrayList with LinkedHashSet (insertion-ordered, O(1)
contains/add). Remove the now-redundant contains() guards — Set.add() is
idempotent. Convert to List<> only for the final sort step.
CWE: CWE-407 (Inefficient Algorithmic Complexity)
Severity: spring-0003 HIGH, spring-0004 MEDIUM
---
.../event/AbstractApplicationEventMulticaster.java | 42 +++++++++----------
1 file changed, 19 insertions(+), 23 deletions(-)
diff --git a/spring-context/src/main/java/org/springframework/context/event/AbstractApplicationEventMulticaster.java b/spring-context/src/main/java/org/springframework/context/event/AbstractApplicationEventMulticaster.java
index aaaaaaa..bbbbbbb 100644
--- a/spring-context/src/main/java/org/springframework/context/event/AbstractApplicationEventMulticaster.java
+++ b/spring-context/src/main/java/org/springframework/context/event/AbstractApplicationEventMulticaster.java
@@ -17,6 +17,7 @@ import java.util.ArrayList;
import java.util.Collection;
import java.util.LinkedHashSet;
+import java.util.LinkedHashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
@@ -233,8 +234,8 @@ public abstract class AbstractApplicationEventMulticaster
private Collection<ApplicationListener<?>> retrieveApplicationListeners(
ResolvableType eventType, @Nullable Class<?> sourceType, @Nullable CachedListenerRetriever retriever) {
- List<ApplicationListener<?>> allListeners = new ArrayList<>();
+ // Use LinkedHashSet: O(1) add/contains, insertion-ordered for stable dispatch order.
+ LinkedHashSet<ApplicationListener<?>> allListenerSet = new LinkedHashSet<>();
Set<ApplicationListener<?>> filteredListeners = (retriever != null ? new LinkedHashSet<>() : null);
Set<String> filteredListenerBeans = (retriever != null ? new LinkedHashSet<>() : null);
@@ -249,7 +250,7 @@ public abstract class AbstractApplicationEventMulticaster
if (supportsEvent(listener, eventType, sourceType)) {
if (retriever != null) {
filteredListeners.add(listener);
}
- allListeners.add(listener);
+ allListenerSet.add(listener);
}
}
@@ -267,18 +268,14 @@ public abstract class AbstractApplicationEventMulticaster
ApplicationListener<?> unwrappedListener =
(ApplicationListener<?>) AopProxyUtils.getSingletonTarget(listener);
if (listener != unwrappedListener) {
if (filteredListeners != null && filteredListeners.contains(unwrappedListener)) {
filteredListeners.remove(unwrappedListener);
filteredListeners.add(listener);
}
- if (allListeners.contains(unwrappedListener)) {
- allListeners.remove(unwrappedListener);
- allListeners.add(listener);
- }
+ // O(1) remove+add on LinkedHashSet — replaces O(n) ArrayList scan
+ if (allListenerSet.remove(unwrappedListener)) {
+ allListenerSet.add(listener);
+ }
}
- if (!allListeners.contains(listener) && supportsEvent(listener, eventType, sourceType)) {
+ if (!allListenerSet.contains(listener) && supportsEvent(listener, eventType, sourceType)) {
if (retriever != null) {
if (beanFactory.isSingleton(listenerBeanName)) {
filteredListeners.add(listener);
@@ -287,7 +284,7 @@ public abstract class AbstractApplicationEventMulticaster
filteredListenerBeans.add(listenerBeanName);
}
}
- allListeners.add(listener);
+ allListenerSet.add(listener);
}
}
else {
@@ -295,7 +292,7 @@ public abstract class AbstractApplicationEventMulticaster
if (retriever != null) {
filteredListeners.remove(listener);
}
- allListeners.remove(listener);
+ allListenerSet.remove(listener);
}
}
}
+ List<ApplicationListener<?>> allListeners = new ArrayList<>(allListenerSet);
AnnotationAwareOrderComparator.sort(allListeners);
if (retriever != null) {
if (CollectionUtils.isEmpty(filteredListenerBeans)) {
@@ -502,14 +499,13 @@ public abstract class AbstractApplicationEventMulticaster
public Collection<ApplicationListener<?>> getApplicationListeners() {
- List<ApplicationListener<?>> allListeners = new ArrayList<>(
- this.applicationListeners.size() + this.applicationListenerBeans.size());
- allListeners.addAll(this.applicationListeners);
+ // LinkedHashSet: O(1) add() deduplicates programmatic + bean-name listeners
+ LinkedHashSet<ApplicationListener<?>> allListenerSet = new LinkedHashSet<>(this.applicationListeners);
if (!this.applicationListenerBeans.isEmpty()) {
BeanFactory beanFactory = getBeanFactory();
for (String listenerBeanName : this.applicationListenerBeans) {
try {
ApplicationListener<?> listener =
beanFactory.getBean(listenerBeanName, ApplicationListener.class);
- if (!allListeners.contains(listener)) { // O(n) scan — eliminated
- allListeners.add(listener);
- }
+ allListenerSet.add(listener); // O(1) — Set.add() is idempotent
}
catch (NoSuchBeanDefinitionException ex) {
}
}
}
+ List<ApplicationListener<?>> allListeners = new ArrayList<>(allListenerSet);
AnnotationAwareOrderComparator.sort(allListeners);
return allListeners;
}