wave8b: 438/196 — rails-0017, hanami-0001, spark-0002 + PDF

defects/hanami/patch/hanami-0001-slice-registrar-filter-set.patch

@@ -0,0 +1,39 @@
+--- a/lib/hanami/slice_registrar.rb
++++ b/lib/hanami/slice_registrar.rb
+@@ -106,8 +106,10 @@ module Hanami
+       def filter_slice_names(slice_names)
+         slice_names = slice_names.map(&:to_s)
+
+         if parent.config.slices
+-          slice_names & parent.config.slices.map { base_slice_name(_1) }
++          allowed = parent.config.slices.map { base_slice_name(_1) }.to_set
++          slice_names.select { |name| allowed.include?(name) }
+         else
+           slice_names
+         end
+
+# CWE-407: Algorithmic Complexity — O(N×M) → O(N+M) for filter_slice_names
+#
+# Defect ID : hanami-0001
+# File      : lib/hanami/slice_registrar.rb
+# Method    : filter_slice_names (private)
+# Severity  : MEDIUM
+#
+# Pattern:
+#   slice_names & parent.config.slices.map { base_slice_name(_1) }
+#
+# Ruby's Array#& (intersection) is implemented as:
+#   for each element in left_array:           # N iterations
+#     right_array.include?(element)           # O(M) linear scan
+# Total: O(N × M) where N = len(slice_names), M = len(config.slices)
+#
+# `filter_slice_names` is called from `load_slices` on every application boot and
+# whenever slices are reloaded (e.g. code reloading in development). In a large
+# Hanami application with many slices (M >> 20) and many candidate names (N >> 20)
+# this creates quadratic work at startup.
+#
+# Fix: materialize the right-hand side into a Set before the membership test.
+# `to_set` costs O(M) once; subsequent `include?` calls are O(1) each.
+#
+# Complexity before: O(N × M)
+# Complexity after:  O(N + M)