comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems

defects/rocketchat/patch/0001.patch

@@ -0,0 +1,58 @@
+--- a/apps/meteor/app/lib/server/lib/sendNotificationsOnMessage.ts
++++ b/apps/meteor/app/lib/server/lib/sendNotificationsOnMessage.ts
+@@ -73,7 +73,8 @@ export const sendNotification = async ({
+ 	if (subscription.u._id === sender._id) {
+ 		return;
+ 	}
+
+-	const hasMentionToUser = mentionIds.includes(subscription.u._id);
++	const hasMentionToUser = mentionIdSet.has(subscription.u._id);
+
+ 	// mute group notifications (@here and @all) if not directly mentioned as well
+@@ -57,7 +57,8 @@ export const sendNotification = async ({
+ 	subscription,
+ 	sender,
+ 	hasReplyToThread,
+ 	hasMentionToAll,
+ 	hasMentionToHere,
+ 	message,
+ 	notificationMessage,
+ 	room,
+-	mentionIds,
++	mentionIdSet,
+ 	disableAllMessageNotifications,
+ }: {
+ 	subscription: SubscriptionAggregation;
+ 	sender: Pick<IUser, '_id' | 'name' | 'username'>;
+ 	hasReplyToThread: boolean;
+ 	hasMentionToAll: boolean;
+ 	hasMentionToHere: boolean;
+ 	message: AtLeast<IMessage, '_id' | 'u' | 'msg' | 't' | 'attachments'>;
+ 	notificationMessage: string;
+ 	room: IRoom;
+-	mentionIds: string[];
++	mentionIdSet: Set<string>;
+ 	disableAllMessageNotifications: boolean;
+@@ -360,13 +360,15 @@ export async function sendMessageNotifications(message: IMessage, room: IRoom,
+ 	const subscriptions = await Subscriptions.col.aggregate<SubscriptionAggregation>([{ $match: query }, lookup, filter, project]).toArray();
+
++	const mentionIdSet = new Set(mentionIds);
++	const usersInThreadSet = new Set(usersInThread ?? []);
++
+ 	subscriptions.forEach(
+ 		(subscription) =>
+ 			void sendNotification({
+ 				subscription,
+ 				sender,
+ 				hasMentionToAll,
+ 				hasMentionToHere,
+ 				message,
+ 				notificationMessage,
+ 				room,
+-				mentionIds,
++				mentionIdSet,
+ 				disableAllMessageNotifications,
+-				hasReplyToThread: usersInThread?.includes(subscription.u._id),
++				hasReplyToThread: usersInThreadSet.has(subscription.u._id),
+ 			}),
+ 	);

defects/rocketchat/patch/0002.patch

@@ -0,0 +1,14 @@
+--- a/apps/meteor/app/lib/server/lib/notifyUsersOnMessage.ts
++++ b/apps/meteor/app/lib/server/lib/notifyUsersOnMessage.ts
+@@ -125,7 +125,8 @@ async function updateUsersSubscriptions(message: IMessage, room: IRoom): Promis
+ 	await Promise.all([
+ 		Subscriptions.setAlertForRoomIdExcludingUserId(message.rid, message.u._id),
+ 		Subscriptions.setOpenForRoomIdExcludingUserId(message.rid, message.u._id),
+ 	]);
+
++	const userIdSet = new Set(userIds);
+ 	subs.forEach((sub) => {
+-		const hasUserMention = userIds.includes(sub.u._id);
++		const hasUserMention = userIdSet.has(sub.u._id);
+ 		const shouldIncUnread = hasUserMention || toAll || toHere || unreadAllMessages;
+ 		void notifyOnSubscriptionChanged(