comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems

defects/synapse/patch/synapse-0001.patch

@@ -0,0 +1,27 @@
+--- a/synapse/server_notices/resource_limits_server_notices.py
++++ b/synapse/server_notices/resource_limits_server_notices.py
+@@ -190,15 +190,15 @@ class ResourceLimitsServerNotices:
+             pass
+
+-        referenced_events: List[str] = []
++        referenced_event_ids: List[str] = []
+         if pinned_state_event is not None:
+-            referenced_events = list(pinned_state_event.content.get("pinned", []))
++            referenced_event_ids = list(pinned_state_event.content.get("pinned", []))
+
+-        events = await self._store.get_events(referenced_events)
++        events = await self._store.get_events(referenced_event_ids)
++        # CWE-407 fix: use a set for O(1) membership and discard instead of O(n) list.remove()
++        referenced_set: set = set(referenced_event_ids)
+         for event_id, event in events.items():
+             if event.type != EventTypes.Message:
+                 continue
+             if event.content.get("msgtype") == ServerNoticeMsgType:
+                 currently_blocked = True
+                 # remove event in case we need to disable blocking later on.
+-                if event_id in referenced_events:
+-                    referenced_events.remove(event.event_id)
++                referenced_set.discard(event.event_id)
+
+-        return currently_blocked, referenced_events
++        return currently_blocked, list(referenced_set)