engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 14:37:02 -04:00
parent 4d3fcc8e73
commit b3842ab6b8
86 changed files with 6516 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
whitepaper/MD5SUMS
View file

@ -1 +1 @@
a2c645839337119dc9236f446146aec4 undefect-cwe407-2026-03-27.pdf
a3214b001e78a8760e0c3531ea9085d5 undefect-cwe407-2026-03-27.pdf

50
whitepaper/full-paper.md
View file

@ -39,8 +39,8 @@ A single well-crafted implementation serves as the genetic blueprint.
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
Code propagates according to its kind — clean architecture begets clean implementations,
elegant solutions inspire elegant variations. The process of generating 194 validated
defect patches across 78 ecosystems in a single research wave demonstrates how truth,
elegant solutions inspire elegant variations. The process of generating 224 validated
defect patches across 101 ecosystems in a single research wave demonstrates how truth,
properly seeded, multiplies. Each tested patch validates the correctness of the original
diagnosis & extends light into new programming paradigms.
@ -336,6 +336,17 @@ stacks, Spark schemas — this is the dominant build cost.
| sdl3-0001 | SDL3 | `SDL_gamepad.c:639` — `HasMappingChangeTracking()` scan per joystick per mapping on DB reload; O(J×M) (800×) | **PATCHED** |
| panda3d-0001 | Panda3D | `camera.cxx:252` — `std::find` in `remove_display_region()`; O(N²) pipeline rebuild (400×) | **PATCHED** |
| panda3d-0002 | Panda3D | `graphicsOutput.cxx:1623` — `std::find` in `do_remove_display_region()` teardown; O(N²) (400×) | **PATCHED** |
| synapse-0002 | Synapse (Matrix) | `handlers/sync.py:1439` — `if user_id in user_ids_in_room` list scan per room per sync; O(R×U) (5,000×) | **PATCHED** |
| weechat-0001 | WeeChat | `irc-protocol.c` — `irc_nick_search()` O(N) list walk in AWAY/NICK/QUIT/KILL handlers; O(C×N) per event (8,000×) | **PATCHED** |
| unrealircd-0001 | UnrealIRCd | `src/channel.c:1282` — `has_common_channels()` IsMember O(c2) scan in O(c1) loop; O(c1×c2) per WHO/MONITOR (42×) | **PATCHED** |
| jvb-0001 | Jitsi Videobridge | `Prioritize.kt:41,52` — `List.contains()` + `List.indexOf()` inside `forEach(conferenceSources)`; O(N²) per alloc cycle (33×) | **PATCHED** |
| jvb-0003 | Jitsi Videobridge | `ConferenceSpeechActivity.java:326` — `ArrayList.contains()` inside `for(conferenceEndpoints)` on join/leave; O(N²) (35×) | **PATCHED** |
| ejabberd-0001 | ejabberd | `src/mod_mam.erl:1029` — `lists:member(LPeer, Always/Never)` on every archived message; O(N×M) (250×) | **PATCHED** |
| asterisk-0001 | Asterisk | `apps/app_meetme.c:948` — `find_conf()` linear `AST_LIST_TRAVERSE` per conference lookup; O(C²) per call burst (1,000×) | **PATCHED** |
| simplex-chat-0001 | SimpleX Chat | `Commands.hs:2327` — `groupMemberId \`elem\` memberIds` list O(K) in `foldr'` over M members; O(M×K) (95×) | **PATCHED** |
| simplex-chat-0002 | SimpleX Chat | `Commands.hs:2389` — same elem pattern in `APIBlockMembersForAll`; O(M×K) (95×) | **PATCHED** |
| simplex-chat-0003 | SimpleX Chat | `Internal.hs:1073` — `\`notElem\` introducedGMIds` list on every group join; O(M×K) (495×) | **PATCHED** |
| rocketchat-0001 | Rocket.Chat | `sendNotificationsOnMessage.ts:79` — `mentionIds.includes()` + `usersInThread.includes()` per subscriber; O(S×M) (200×) | **PATCHED** |
### MEDIUM — Real defect, bounded or cold path
@ -393,6 +404,25 @@ stacks, Spark schemas — this is the dominant build cost.
| phoenix-0002 | Phoenix | `router.ex` — `pipe_through()` duplicate pipe check O(P²) per router compile; fix: `MapSet` (72×) | **PATCHED** |
| gin-0001 | Gin | `gin/gin.go:708` — `engine.trees []methodTree` O(M) scan per HTTP request in `handleHTTPRequest()`; fix: `engine.methodMap map[string]*node` (8×) | **PATCHED** |
| fiber-0001 | Fiber | `fiber/bind.go:391` — `slices.Contains(customBinder.MIMETypes(), ctype)` O(B×M) per request; fix: `app.customBindersByMIME` map (42×) | **PATCHED** |
| synapse-0001 | Synapse (Matrix) | `resource_limits_server_notices.py:204` — `list.remove()` + `list.contains()` O(N) each inside event loop; O(N²); fix: `set.discard()` (3,001×) | **PATCHED** |
| dendrite-0001 | Dendrite (Matrix) | `storage_consumer.go:243` — double loop over `PrevEventIDs()` × `prevEvents` per `WriteEvent`; O(P×E) (16×) | **PATCHED** |
| dendrite-0002 | Dendrite (Matrix) | `perform_backfill.go:438` — O(E×P) nested scan over `bwExtrems` to find prev-event extremity; fix: reverse map (444×) | **PATCHED** |
| element-web-0001 | Element Web | `TextForEvent.tsx:503` — `users.indexOf()` in two `forEach` loops for power-level dedup; O(N²); fix: `Set` (464×) | **PATCHED** |
| unrealircd-0002 | UnrealIRCd | `modules/sjoin.c:292` — `find_membership_link` O(C) per member during SJOIN timestamp collision; fix: direct backpointer (38×) | **PATCHED** |
| weechat-0002 | WeeChat | `irc-nick.c:612` — `irc_nick_search()` per nick in NAMES/353 dedup; O(N²) large channels; fix: `GHashTable` (4,000×) | **PATCHED** |
| jvb-0002 | Jitsi Videobridge | `BandwidthAllocator.kt:222` — `List.contains()` in `selectedSources` getter per alloc cycle; fix: `LinkedHashSet` (19×) | **PATCHED** |
| linphone-0001 | Linphone | `offeranswer.cpp:237` — `genericMatch` O(L×R) nested codec scan + `matchCryptoAlgo` per SDP negotiation (5×) | **PATCHED** |
| freeswitch-0001 | FreeSWITCH | `mod_conference.c:651` — relationship linked-list scan O(R) per sample per member pair in 50Hz mix thread; O(S×M²×R) | **PATCHED** |
| ejabberd-0002 | ejabberd | `mod_shared_roster.erl:356` — `lists:member` in `is_user_in_group` + subscription stanza; O(N_group×msg) (2,500×) | **PATCHED** |
| asterisk-0002 | Asterisk | `app_confbridge.c` — `AST_LIST_TRAVERSE` over `active_list`/`waiting_list` per AMI kick/mute; O(P×ops) (2,000×) | **PATCHED** |
| postfix-0001 | Postfix | `resolve.c:161` — `string_list_match()` O(K) ARGV scan for virtual/relay domains per RCPT-TO; fix: `HTABLE` (500×) | **PATCHED** |
| postfix-0002 | Postfix | `cleanup_masquerade.c:108` — O(E) exceptions scan + O(D) masq-domains per address; fix: hash cache (200×) | **PATCHED** |
| opensmtpd-0001 | OpenSMTPD | `ruleset.c:234` — `TAILQ_FOREACH` over R rules per envelope in `ruleset_match()`; fix: domain dispatch dict (146×) | **PATCHED** |
| dovecot-0001 | Dovecot | `dsync-mailbox-import.c:1336` — `array_foreach_elem` O(K) keyword scan per mail change per query; fix: lazy hash set (7×) | **PATCHED** |
| rocketchat-0002 | Rocket.Chat | `notifyUsersOnMessage.ts:129` — `userIds.includes()` O(U) per subscription in `updateUsersSubscriptions`; fix: `Set` (30×) | **PATCHED** |
| mattermost-0001 | Mattermost | `role.go:258` — `CheckRolesExist()` nested O(n×m) scan per role assignment; fix: `map[string]bool` (50×) | **PATCHED** |
| jami-daemon-0001 | Jami | `conversation.cpp:832` — `std::find` on `replies` vector per git commit in `loadMessages()`; fix: `unordered_set` (211×) | **PATCHED** |
| jami-daemon-0002 | Jami | `conversation_module.cpp:2341` — `std::find` on `std::set<string>` iterator bypasses `set.find()` O(log n); fix: `members.count()` (49×) | **PATCHED** |
| create-0001 | Create mod | `TrackGraph.findDisconnectedGraphs` — `ArrayList.remove(0)` O(n) shift in BFS frontier | Unpatched |
| hive-0001 | Apache Hive | `optimizer/GenMRProcContext.java:248` — `ArrayList<Operator>.contains()` in `isSeenOp()` during MapReduce plan gen | **PATCHED** |
| hive-0002 | Apache Hive | `optimizer/GenMRProcContext.java:142` — `List<FileSinkOperator>.contains()` in file sink dedup | **PATCHED** |
@ -471,7 +501,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
chains with depths in this range.
**194 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod).**
**224 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod).**
---
@ -2271,6 +2301,18 @@ The following systems were scanned and confirmed free of CWE-407:
**ORM layer:** Hibernate — 5 defects PATCHED: schema-mapping addColumn/addReferencedColumn/addIndex LinkedHashSet hibernate-0001/2/3 (19×), FK second-pass hibernate-0004, orderHierarchy hibernate-0005. MyBatis — mybatis-0001 PATCHED: sort comparator HashMap (12×). Entity Framework Core — 3 defects PATCHED: FindGenerationProperty HashSet efcore-0001 (250×), AddPrincipals HashSet efcore-0002 (250×), FK discovery efcore-0003 (6×). Diesel — 3 defects PATCHED: SQLite/MySQL row BTreeMap index diesel-0001/2/3 (51×). SQLAlchemy — 2 defects PATCHED: _values_bindparam Set sqlalchemy-0001 (500×), evaluated_keys Set sqlalchemy-0002 (500×). Peewee — peewee-0001 PATCHED: _SortedFieldList bisect (42×). Sequelize — 2 defects PATCHED: bulkInsert Set sequelize-0001 (50×), expandIncludeAll Set sequelize-0002 (250×). TypeORM — 3 defects PATCHED: OrmUtils.uniq typeorm-0001 (500×), diffColumns typeorm-0002 (125×), updatedColumns typeorm-0003 (100×). Doctrine ORM — 3 defects PATCHED: hydrator discriminator doctrine-0001 (26×), addSubClass doctrine-0002 (250×), SqlWalker partial doctrine-0003 (130×). GORM — gorm-0001 PATCHED: sortCallbacks getRIndex (194×). Exposed ORM — 3 defects PATCHED: schema migration exposed-0001 (118×), keyword scan exposed-0002 (144×), clone filter exposed-0003 (6×). SeaORM — 4 defects PATCHED: establish_links seaorm-0001 (501×), permissions seaorm-0002 (502×), sorted_tables seaorm-0003 (500×), topo-sort seaorm-0004 (28×). Rails Active Record — 3 additional defects PATCHED (rails-0009/10/11): filter params (450×), encryption filter (250×), timezone skip-list (20×).
**Matrix protocol:** Synapse — 2 defects PATCHED: synapse-0001 (3,001×, MEDIUM — `list.remove()` + `list.contains()` in server_notices resource_limits event loop), synapse-0002 (5,000×, HIGH — `if user_id in user_ids_in_room` list scan per room per sync in `handlers/sync.py`). Dendrite — 2 defects PATCHED: dendrite-0001 (16×, MEDIUM — double loop over prevEventIDs per WriteEvent in `storage_consumer.go`), dendrite-0002 (444×, MEDIUM — O(E×P) nested bwExtrems scan in backfill, fix: reverse map). Element Web — element-web-0001 (464×, MEDIUM — `users.indexOf()` in two forEach loops for power-level dedup in `TextForEvent.tsx`, fix: `Set`).
**IRC:** InspIRCd — CLEAN: `MemberMap` is `std::unordered_map<User*, Membership>`, all HasUser/GetUser O(1). UnrealIRCd — 2 defects PATCHED: unrealircd-0001 (42×, HIGH — `has_common_channels()` O(c1×c2) IsMember chain scan in `/WHO`/MONITOR), unrealircd-0002 (38×, MEDIUM — SJOIN timestamp collision find_membership_link per member). WeeChat — 2 defects PATCHED: weechat-0001 (8,000×, HIGH — `irc_nick_search()` O(C×N) in AWAY/NICK/QUIT/KILL handlers, fix: `GHashTable` per channel), weechat-0002 (4,000×, MEDIUM — `irc_nick_search()` dedup during NAMES/353 reply, O(N²) on large channels).
**XMPP / PBX:** Prosody — CLEAN: Lua tables (hash maps) for all hot-path membership; affiliations, sessions, roster, MUC occupants all O(1). ejabberd — 2 defects PATCHED: ejabberd-0001 (250×, HIGH — `lists:member` in `mod_mam:should_archive_peer()` per archived message), ejabberd-0002 (2,500×, MEDIUM — `lists:member` in `mod_shared_roster:is_user_in_group` + subscription stanzas). Asterisk — 2 defects PATCHED: asterisk-0001 (1,000×, MEDIUM — `find_conf()` linear `AST_LIST_TRAVERSE` in `app_meetme`, fix: `ao2_container` hash), asterisk-0002 (2,000×, MEDIUM — `AST_LIST_TRAVERSE` per AMI kick/mute on `active_list` in `app_confbridge`, fix: `ao2_container` by name).
**VoIP:** Jitsi Videobridge — 3 defects PATCHED: jvb-0001 (33×, HIGH — `List.contains()` + `indexOf()` in `Prioritize.kt` per alloc cycle), jvb-0002 (19×, MEDIUM — `selectedSources` getter per cycle), jvb-0003 (35×, HIGH — `ArrayList.contains()` in `ConferenceSpeechActivity` per join/leave). Mumble — CLEAN: uses `QSet<int>` and `QSet<ServerUser*>` throughout. Linphone — linphone-0001 (5×, MEDIUM — `genericMatch` O(L×R) nested codec scan + `matchCryptoAlgo` per SDP negotiation). FreeSWITCH — freeswitch-0001 (CRITICAL — relationship linked-list scan O(R) per sample per member pair in 50Hz audio mix thread; O(S×M²×R) per mix cycle). SimpleX Chat — 3 defects PATCHED: simplex-chat-0001/0002 (95×, HIGH — `\`elem\` memberIds` list scan per group member in `APIMembersRole`/`APIBlockMembersForAll`), simplex-chat-0003 (495×, HIGH — `\`notElem\` introducedGMIds` list on every group join event). Signal Server — CLEAN: all hot-path collections are `HashSet<UUID>`, `HashSet<Byte>`, `EnumSet` throughout.
**Chat platforms:** Rocket.Chat — 2 defects PATCHED: rocketchat-0001 (200×, HIGH — `mentionIds.includes()` + `usersInThread.includes()` per subscriber per message), rocketchat-0002 (30×, MEDIUM — `userIds.includes()` per subscription in `updateUsersSubscriptions`). Mattermost — mattermost-0001 (50×, LOW — `CheckRolesExist()` nested O(n×m) loop, fix: `map[string]bool`). Jami — 2 defects PATCHED: jami-daemon-0001 (211×, MEDIUM — `std::find` on `replies` vector per git commit in `loadMessages()`), jami-daemon-0002 (49×, LOW — `std::find` on `std::set` iterator bypasses `set.find()`). Zulip — CLEAN: Python `set` and `ahocorasick.Automaton` throughout. TeamSpeak 3/5 — PROPRIETARY, source unavailable.
**Mail servers (SMTP/IMAP):** Postfix — 2 defects PATCHED: postfix-0001 (500×, MEDIUM — `string_list_match()` O(K) ARGV scan for virtual/relay domains per RCPT-TO), postfix-0002 (200×, MEDIUM — `masq_exceptions` O(E) scan + masq-domains O(D) per address in `cleanup_masquerade_external()`). OpenSMTPD — opensmtpd-0001 (146×, MEDIUM — `TAILQ_FOREACH` over R rules per envelope in `ruleset_match()`, fix: domain dispatch dict). Dovecot — dovecot-0001 (7×, LOW — `array_foreach_elem` O(K) keyword scan per mail change per query in `dsync-mailbox-import.c`). Exim — CLEAN: uses `tree_search()` (RB tree O(log n)) for all duplicate detection; `domain_cache` prevents repeat scans.
**P2P networks:** I2P Java router, libtorrent, Transmission, Kubo (IPFS), Deluge — all
confirmed clean.
@ -3110,4 +3152,4 @@ foundational tools — compilers, package managers, database query planners, cry
toolchains, routing daemons, event streaming platforms, web frameworks, query optimizers,
browser runtimes, and ORM layers — the fix is a one-line data structure substitution with
no behavioral change, and we have patched, tested, and benchmarked every confirmed site
across 78 ecosystems.
across 101 ecosystems.

BIN
whitepaper/undefect-cwe407-2026-03-27.pdf
View file

Binary file not shown.