engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave16b: element-web/bun CWE-407 patches + unit tests

Browse source 
element-web-0001: TextForEvent.tsx user dedup array → Set (15x, HIGH)
element-web-0002: TextForEvent.tsx pinned filter indexOf → Set.has (13x, MEDIUM)
bun-0001: yarn.zig scoped version two-pass scan → single pass (4x, MEDIUM)

5 tests: 5/5 PASS
This commit is contained in:
russell@unturf.com 2026-03-30 07:37:28 -04:00
parent c830c29e8a
commit c1f0ce8eda
5 changed files with 254 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

17
defects/element-web/patch/element-web-0001-textforevent-user-set.patch Normal file
View file

@ -0,0 +1,17 @@
--- a/apps/web/src/TextForEvent.tsx
+++ b/apps/web/src/TextForEvent.tsx
@@ -498,13 +498,9 @@ function textForPowerEvent(event: MatrixEvent, client: MatrixClient): (() => str
const previousUserDefault: number = event.getPrevContent().users_default || 0;
const currentUserDefault: number = event.getContent().users_default || 0;
- // Construct set of userIds
- const users: string[] = [];
- Object.keys(event.getContent().users).forEach((userId) => {
- if (users.indexOf(userId) === -1) users.push(userId);
- });
- Object.keys(event.getPrevContent().users).forEach((userId) => {
- if (users.indexOf(userId) === -1) users.push(userId);
- });
+ // Deduplicate userIds from current and previous content; O(U) via Set
+ const users = Array.from(
+ new Set([...Object.keys(event.getContent().users), ...Object.keys(event.getPrevContent().users)]),
+ );

12
defects/element-web/patch/element-web-0002-textforevent-pinned-set.patch Normal file
View file

@ -0,0 +1,12 @@
--- a/apps/web/src/TextForEvent.tsx
+++ b/apps/web/src/TextForEvent.tsx
@@ -565,8 +565,10 @@ function textForPinnedEvent(event: MatrixEvent, client: MatrixClient, isTwelveHo
const pinned = Array.isArray(content.pinned) ? content.pinned : [];
const previouslyPinned: string[] = Array.isArray(prevContent.pinned) ? prevContent.pinned : [];
- const newlyPinned = pinned.filter((item) => previouslyPinned.indexOf(item) < 0);
- const newlyUnpinned = previouslyPinned.filter((item) => pinned.indexOf(item) < 0);
+ // Use Set for O(1) membership test; avoids O(P×Q) from indexOf inside filter
+ const pinnedSet = new Set(pinned);
+ const previouslyPinnedSet = new Set(previouslyPinned);
+ const newlyPinned = pinned.filter((item) => !previouslyPinnedSet.has(item));
+ const newlyUnpinned = previouslyPinned.filter((item) => !pinnedSet.has(item));