engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave16b: element-web/bun CWE-407 patches + unit tests

Browse source 
element-web-0001: TextForEvent.tsx user dedup array → Set (15x, HIGH)
element-web-0002: TextForEvent.tsx pinned filter indexOf → Set.has (13x, MEDIUM)
bun-0001: yarn.zig scoped version two-pass scan → single pass (4x, MEDIUM)

5 tests: 5/5 PASS
This commit is contained in:
russell@unturf.com 2026-03-30 07:37:28 -04:00
parent c830c29e8a
commit c1f0ce8eda
5 changed files with 254 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

41
defects/bun/patch/bun-0001-yarn-version-single-pass.patch Normal file
View file

@ -0,0 +1,41 @@
--- a/src/install/yarn.zig
+++ b/src/install/yarn.zig
@@ -773,20 +773,18 @@ fn populatePackageVersionMap(
var found_existing = false;
var found_new = false;
+ var found_package_id: Install.PackageID = 0;
for (list.items) |item| {
if (strings.eql(item.version, existing.version)) found_existing = true;
- if (strings.eql(item.version, version)) found_new = true;
+ if (strings.eql(item.version, version)) {
+ found_new = true;
+ found_package_id = item.package_id; // capture in first pass
+ }
}
if (!found_existing) {
try list.append(.{
.yarn_idx = existing.yarn_idx,
.version = existing.version,
.package_id = existing.package_id,
});
}
if (!found_new) {
const package_id = next_package_id;
next_package_id += 1;
try list.append(.{
.yarn_idx = yarn_idx,
.version = version,
.package_id = package_id,
});
yarn_entry_to_package_id[yarn_idx] = package_id;
} else {
- for (list.items) |item| { // O(M) second scan — eliminated
- if (strings.eql(item.version, version)) {
- yarn_entry_to_package_id[yarn_idx] = item.package_id;
- break;
- }
- }
+ yarn_entry_to_package_id[yarn_idx] = found_package_id;
}