engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 14:37:02 -04:00
parent 4d3fcc8e73
commit b3842ab6b8
86 changed files with 6516 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

30
defects/simplex-chat/patch/simplex-chat-0001.patch Normal file
View file

@ -0,0 +1,30 @@
--- a/src/Simplex/Chat/Library/Commands.hs
+++ b/src/Simplex/Chat/Library/Commands.hs
@@ -2310,8 +2310,9 @@ processChatCommand vr nm = \case
APIMembersRole groupId memberIds newRole -> withUser $ \user ->
withGroupLock "memberRole" groupId $ do
g@(Group gInfo members) <- withFastStore $ \db -> getGroup db vr user groupId
- when (selfSelected gInfo) $ throwCmdError "can't change role for self"
- let (invitedMems, currentMems, unchangedMems, maxRole, anyAdmin, anyPending) = selectMembers members
+ let gmIdSet = S.fromList (L.toList memberIds)
+ when (selfSelected gmIdSet gInfo) $ throwCmdError "can't change role for self"
+ let (invitedMems, currentMems, unchangedMems, maxRole, anyAdmin, anyPending) = selectMembers gmIdSet members
when (length invitedMems + length currentMems + length unchangedMems /= length memberIds) $ throwChatError CEGroupMemberNotFound
when (length memberIds > 1 && (anyAdmin || newRole >= GRAdmin)) $
throwCmdError "can't change role of multiple members when admins selected, or new role is admin"
@@ -2326,12 +2327,12 @@ processChatCommand vr nm = \case
pure $ CRMembersRoleUser {user, groupInfo = gInfo, members = changed1 <> changed2, toRole = newRole} -- same order is not guaranteed
where
- selfSelected GroupInfo {membership} = elem (groupMemberId' membership) memberIds
- selectMembers :: [GroupMember] -> ([GroupMember], [GroupMember], [GroupMember], GroupMemberRole, Bool, Bool)
- selectMembers = foldr' addMember ([], [], [], GRObserver, False, False)
+ selfSelected gmIdSet GroupInfo {membership} = S.member (groupMemberId' membership) gmIdSet
+ selectMembers :: S.Set GroupMemberId -> [GroupMember] -> ([GroupMember], [GroupMember], [GroupMember], GroupMemberRole, Bool, Bool)
+ selectMembers gmIdSet = foldr' addMember ([], [], [], GRObserver, False, False)
where
addMember m@GroupMember {groupMemberId, memberStatus, memberRole} (invited, current, unchanged, maxRole, anyAdmin, anyPending)
- | groupMemberId `elem` memberIds =
+ | groupMemberId `S.member` gmIdSet =
let maxRole' = max maxRole memberRole
anyAdmin' = anyAdmin || memberRole >= GRAdmin
anyPending' = anyPending || memberPending m

30
defects/simplex-chat/patch/simplex-chat-0002.patch Normal file
View file

@ -0,0 +1,30 @@
--- a/src/Simplex/Chat/Library/Commands.hs
+++ b/src/Simplex/Chat/Library/Commands.hs
@@ -2378,8 +2378,9 @@ processChatCommand vr nm = \case
APIBlockMembersForAll groupId memberIds blockFlag -> withUser $ \user ->
withGroupLock "blockForAll" groupId $ do
Group gInfo members <- withFastStore $ \db -> getGroup db vr user groupId
- when (selfSelected gInfo) $ throwCmdError "can't block/unblock self"
- let (blockMems, remainingMems, maxRole, anyAdmin, anyPending) = selectMembers members
+ let gmIdSet = S.fromList (L.toList memberIds)
+ when (selfSelected gmIdSet gInfo) $ throwCmdError "can't block/unblock self"
+ let (blockMems, remainingMems, maxRole, anyAdmin, anyPending) = selectMembers gmIdSet members
when (length blockMems /= length memberIds) $ throwChatError CEGroupMemberNotFound
when (length memberIds > 1 && anyAdmin) $ throwCmdError "can't block/unblock multiple members when admins selected"
when anyPending $ throwCmdError "can't block/unblock members pending approval"
@@ -2388,11 +2389,11 @@ processChatCommand vr nm = \case
blockMembers user gInfo blockMems remainingMems
where
- selfSelected GroupInfo {membership} = elem (groupMemberId' membership) memberIds
- selectMembers :: [GroupMember] -> ([GroupMember], [GroupMember], GroupMemberRole, Bool, Bool)
- selectMembers = foldr' addMember ([], [], GRObserver, False, False)
+ selfSelected gmIdSet GroupInfo {membership} = S.member (groupMemberId' membership) gmIdSet
+ selectMembers :: S.Set GroupMemberId -> [GroupMember] -> ([GroupMember], [GroupMember], GroupMemberRole, Bool, Bool)
+ selectMembers gmIdSet = foldr' addMember ([], [], GRObserver, False, False)
where
addMember m@GroupMember {groupMemberId, memberRole} (block, remaining, maxRole, anyAdmin, anyPending)
- | groupMemberId `elem` memberIds =
+ | groupMemberId `S.member` gmIdSet =
let maxRole' = max maxRole memberRole
anyAdmin' = anyAdmin || memberRole >= GRAdmin
anyPending' = anyPending || memberPending m

17
defects/simplex-chat/patch/simplex-chat-0003.patch Normal file
View file

@ -0,0 +1,17 @@
--- a/src/Simplex/Chat/Library/Internal.hs
+++ b/src/Simplex/Chat/Library/Internal.hs
@@ -1064,11 +1064,12 @@ introduceToRemaining :: VersionRangeChat -> User -> GroupInfo -> GroupMember -> CM ()
introduceToRemaining vr user gInfo m = do
(members, introducedGMIds) <-
withStore' $ \db -> (,) <$> getGroupMembers db vr user gInfo <*> getIntroducedGroupMemberIds db m
- let recipients = filter (introduceMemP introducedGMIds) members
+ let introducedSet = S.fromList introducedGMIds
+ recipients = filter (introduceMemP introducedSet) members
introduceMember vr user gInfo m recipients Nothing
where
- introduceMemP introducedGMIds mem =
+ introduceMemP introducedSet mem =
memberCurrent mem
- && groupMemberId' mem `notElem` introducedGMIds
+ && groupMemberId' mem `S.notMember` introducedSet
&& groupMemberId' mem /= groupMemberId' m