engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Browse source 
Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K
This commit is contained in:
russell@unturf.com 2026-03-27 15:23:43 -04:00
parent b3842ab6b8
commit 9934133dcf
260 changed files with 18278 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

90
defects/tomcat/unit/TomcatTest.java Normal file
View file

@ -0,0 +1,90 @@
package unit;
import java.util.*;
/**
* TomcatTest — CWE-407 benchmark for tomcat-0001
*
* Models ReplicationValve.registerReplicationSession() O(N²) ArrayList.contains()
* cross-context session dedup vs. O(N) LinkedHashSet.add().
*
* Real code (java/org/apache/catalina/ha/tcp/ReplicationValve.java:265-275):
* if (!sessions.contains(session)) { // O(n) ArrayList scan → O(n²) total
* sessions.add(session);
* }
*
* Fix: LinkedHashSet<DeltaSession> — O(1) add, no contains() needed.
*/
public class TomcatTest {
static void bench(String label, Runnable slow, Runnable fast, long sOps, long fOps) {
slow.run(); fast.run();
long t0 = System.nanoTime(); slow.run(); long sMs = (System.nanoTime() - t0) / 1_000_000;
long t1 = System.nanoTime(); fast.run(); long fMs = (System.nanoTime() - t1) / 1_000_000;
double speedup = fMs > 0 ? (double) sMs / fMs : 0;
System.out.printf(" %-54s slow:%4dms (%,d ops) fast:%4dms (%,d ops) speedup:%.0fx%n",
label, sMs, sOps, fMs, fOps, speedup);
}
/** Returns total equals() comparisons performed (slow path) */
static long slowRegister(int N, int requests) {
long ops = 0;
for (int req = 0; req < requests; req++) {
List<Integer> sessions = new ArrayList<>();
for (int s = 0; s < N; s++) {
// simulate contains(): walk entire list
boolean found = false;
for (int i = 0; i < sessions.size(); i++) {
ops++;
if (sessions.get(i).equals(s)) { found = true; break; }
}
if (!found) sessions.add(s);
}
}
return ops;
}
/** Returns total operations (O(1) each — fast path) */
static long fastRegister(int N, int requests) {
long ops = 0;
for (int req = 0; req < requests; req++) {
LinkedHashSet<Integer> sessions = new LinkedHashSet<>(N * 2);
for (int s = 0; s < N; s++) {
ops++; // O(1) set.add()
sessions.add(s);
}
}
return ops;
}
public static void main(String[] args) {
System.out.println("TomcatTest — tomcat-0001: ReplicationValve cross-context ArrayList.contains() → LinkedHashSet");
System.out.println();
System.out.println(" [ReplicationValve.registerReplicationSession() cross-context session dedup]");
int[][] cases = {{20, 50000}, {50, 20000}, {100, 10000}};
for (int[] c : cases) {
int N = c[0], R = c[1];
bench(
String.format("N=%d sessions per request, %,d requests", N, R),
() -> slowRegister(N, R),
() -> fastRegister(N, R),
(long) N * (N - 1) / 2 * R,
(long) N * R
);
}
System.out.println();
System.out.println("Defect : java/org/apache/catalina/ha/tcp/ReplicationValve.java:265-275");
System.out.println(" sessions.contains(session) — ArrayList O(n) per call → O(n²) total");
System.out.println("Fix : LinkedHashSet<DeltaSession> — O(1) add, no contains() check needed");
System.out.println("Ticket : tomcat-0001-replicationvalve-crosscontext-arraylist-contains.md");
System.out.println();
int pass = 0;
long s0 = slowRegister(100, 100), f0 = fastRegister(100, 100);
assert s0 > f0 * 10 : "tomcat-0001 expected >10x; slow=" + s0 + " fast=" + f0; pass++;
System.out.printf("%d/1 PASS — tomcat-0001: CWE-407 in Tomcat ReplicationValve session dedup%n", pass);
System.out.printf("Hotpath: every clustered request with N cross-context DeltaSessions registered%n");
}
}