engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 14:37:02 -04:00
parent 4d3fcc8e73
commit b3842ab6b8
86 changed files with 6516 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

29
defects/dendrite/patch/dendrite-0001.patch Normal file
View file

@ -0,0 +1,29 @@
--- a/syncapi/storage/shared/storage_consumer.go
+++ b/syncapi/storage/shared/storage_consumer.go
@@ -238,14 +238,15 @@ func (d *Database) updateRoomIDsWithEventTypes(ctx context.Context, txn *sql.Tx
prevEvents, err := d.OutputEvents.SelectEvents(ctx, txn, ev.PrevEventIDs(), nil, false)
if err != nil {
return err
}
- var found bool
- for _, eID := range ev.PrevEventIDs() {
- found = false
- for _, prevEv := range prevEvents {
- if eID == prevEv.EventID() {
- found = true
- }
- }
- // If the event is missing, consider it a backward extremity.
- if !found {
+ // CWE-407 fix: pre-build a set of fetched event IDs for O(1) lookup
+ // instead of O(P*E) double loop (P=prevEventIDs count, E=fetched events count).
+ prevEventSet := make(map[string]bool, len(prevEvents))
+ for _, prevEv := range prevEvents {
+ prevEventSet[prevEv.EventID()] = true
+ }
+ for _, eID := range ev.PrevEventIDs() {
+ // If the event is missing from storage, consider it a backward extremity.
+ if !prevEventSet[eID] {
if err = d.BackwardExtremities.InsertsBackwardExtremity(ctx, txn, ev.RoomID().String(), ev.EventID(), eID); err != nil {
return err
}

29
defects/dendrite/patch/dendrite-0002.patch Normal file
View file

@ -0,0 +1,29 @@
--- a/roomserver/internal/perform/perform_backfill.go
+++ b/roomserver/internal/perform/perform_backfill.go
@@ -430,17 +430,20 @@ func (b *backfillRequester) ServersAtEvent(ctx context.Context, roomID, eventID string) []spec.ServerName {
// its successor, so look it up.
successor := ""
-FindSuccessor:
- for sucID, prevEventIDs := range b.bwExtrems {
- for _, pe := range prevEventIDs {
- if pe == eventID {
- successor = sucID
- break FindSuccessor
- }
- }
- }
+ // CWE-407 fix: build reverse map from prevEventID → successorID once,
+ // replacing O(E*P) nested loop with O(1) map lookup.
+ // (Called once per ServersAtEvent invocation; bwExtrems is set at backfillRequester creation.)
+ prevToSuccessor := make(map[string]string)
+ for sucID, prevEventIDs := range b.bwExtrems {
+ for _, pe := range prevEventIDs {
+ prevToSuccessor[pe] = sucID
+ }
+ }
+ successor = prevToSuccessor[eventID]
+
if successor == "" {
logrus.WithField("event_id", eventID).Error("ServersAtEvent: failed to find successor of this event to determine room state")
return nil
}