comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems

defects/synapse/patch/synapse-0002.patch

@@ -0,0 +1,11 @@
+--- a/synapse/handlers/sync.py
++++ b/synapse/handlers/sync.py
+@@ -1437,7 +1437,8 @@ class SyncHandler:
+                 if event.membership == Membership.JOIN:
+-                    user_ids_in_room = await self.store.get_users_in_room(room_id)
+-                    if user_id in user_ids_in_room:
++                    # CWE-407 fix: get_users_in_room returns Sequence[str] (List); convert to set
++                    # for O(1) membership test instead of O(n) linear scan over all room members.
++                    user_ids_in_room = frozenset(await self.store.get_users_in_room(room_id))
++                    if user_id in user_ids_in_room:
+                         mutable_joined_room_ids.add(room_id)