engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems)

Browse source 
Hibernate (5 HIGH): addColumn/addReferencedColumn/addIndex ArrayList→LinkedHashSet (19x)
  FK second-pass LinkedHashSet, orderHierarchy LinkedHashSet
MyBatis (1 MEDIUM): sortConstructorMappings indexOf→HashMap (12x)
EF Core (2 HIGH + 1 MEDIUM): FindGenerationProperty HashSet (250x),
  AddPrincipals HashSet (250x), FK discovery HashSet (6x)
Diesel (3 MEDIUM): SQLite/MySQL row position()→BTreeMap (51x)
SQLAlchemy (2 HIGH): _values_bindparam Set (500x), evaluated_keys Set (500x)
Peewee (1 MEDIUM): _SortedFieldList.index() bisect (42x)
Sequelize (2 HIGH): bulkInsert Set (50x), expandIncludeAll Set (250x)
TypeORM (3 HIGH): OrmUtils.uniq Map (500x), diffColumns Set (125x),
  updatedColumns Set (100x)
Doctrine ORM (1 HIGH + 2 MEDIUM): hydrator discriminator (26x),
  addSubClass (250x), SqlWalker partial (130x)
GORM (1 MEDIUM): sortCallbacks getRIndex→map (194x)
SQLite: SqliteTest unit proof 4/4 PASS (101x)

Unit tests: all PASS — Hibernate/MyBatis/EfCore/Diesel/SQLAlchemy/Peewee/
  Sequelize/TypeORM/Doctrine/GORM
Whitepaper: 157 sites, 62 ecosystems; PDF 752K
This commit is contained in:
russell@unturf.com 2026-03-27 13:34:26 -04:00
parent db2986ae44
commit d4ed2dff91
49 changed files with 4025 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

47
defects/efcore/patch/efcore-0001-find-generation-property-hashset.patch Normal file
View file

@ -0,0 +1,47 @@
diff --git a/src/EFCore/Metadata/Internal/PropertyExtensions.cs b/src/EFCore/Metadata/Internal/PropertyExtensions.cs
index xxxxxxx..xxxxxxx 100644
--- a/src/EFCore/Metadata/Internal/PropertyExtensions.cs
+++ b/src/EFCore/Metadata/Internal/PropertyExtensions.cs
@@ -50,20 +50,23 @@ namespace Microsoft.EntityFrameworkCore.Metadata.Internal;
public static IProperty? FindGenerationProperty(this IProperty property)
{
- var traversalList = new List<IProperty> { property };
+ // efcore-0001 fix: use HashSet for O(1) visited check in BFS traversal.
+ // Previously List<IProperty>: traversalList.Contains() is O(N) per call,
+ // called inside a while loop over traversalList × foreignKey.Properties loop,
+ // giving O(D²) total cost where D = FK chain depth.
+ // HashSet<IProperty> reduces membership check to O(1), fixing CWE-407.
+ var traversalList = new List<IProperty> { property };
+ var traversalSet = new HashSet<IProperty>(ReferenceEqualityComparer.Instance) { property };
var index = 0;
while (index < traversalList.Count)
{
var currentProperty = traversalList[index];
if (currentProperty.RequiresValueGenerator())
{
return currentProperty;
}
foreach (var foreignKey in currentProperty.GetContainingForeignKeys())
{
for (var propertyIndex = 0; propertyIndex < foreignKey.Properties.Count; propertyIndex++)
{
if (currentProperty == foreignKey.Properties[propertyIndex])
{
var nextProperty = foreignKey.PrincipalKey.Properties[propertyIndex];
- if (!traversalList.Contains(nextProperty))
+ if (traversalSet.Add(nextProperty))
{
traversalList.Add(nextProperty);
}
}
}
}
index++;
}
return null;
}

43
defects/efcore/patch/efcore-0002-add-principals-hashset.patch Normal file
View file

@ -0,0 +1,43 @@
diff --git a/src/EFCore/Metadata/IReadOnlyProperty.cs b/src/EFCore/Metadata/IReadOnlyProperty.cs
index xxxxxxx..xxxxxxx 100644
--- a/src/EFCore/Metadata/IReadOnlyProperty.cs
+++ b/src/EFCore/Metadata/IReadOnlyProperty.cs
@@ -229,19 +229,27 @@ namespace Microsoft.EntityFrameworkCore.Metadata;
IReadOnlyList<T> GetPrincipals<T>()
where T : IReadOnlyProperty
{
var principals = new List<T> { (T)this };
- AddPrincipals((T)this, principals);
+ var visited = new HashSet<T>(ReferenceEqualityComparer.Instance) { (T)this };
+ AddPrincipals((T)this, principals, visited);
return principals;
}
- private static void AddPrincipals<T>(T property, List<T> visited)
+ // efcore-0002 fix: pass a HashSet<T> for O(1) duplicate detection.
+ // Previously List<T>: visited.Contains() is O(N) per call, invoked inside
+ // a recursive traversal over foreignKey.Properties × FK chains, giving
+ // O(P²) cost where P = principal chain length. HashSet reduces to O(P).
+ private static void AddPrincipals<T>(T property, List<T> principals, HashSet<T> visited)
where T : IReadOnlyProperty
{
foreach (var foreignKey in property.GetContainingForeignKeys())
{
for (var propertyIndex = 0; propertyIndex < foreignKey.Properties.Count; propertyIndex++)
{
if (ReferenceEquals(property, foreignKey.Properties[propertyIndex]))
{
var principal = (T)foreignKey.PrincipalKey.Properties[propertyIndex];
- if (!visited.Contains(principal))
+ if (visited.Add(principal))
{
- visited.Add(principal);
-
- AddPrincipals(principal, visited);
+ principals.Add(principal);
+ AddPrincipals(principal, principals, visited);
}
}
}
}
}

43
defects/efcore/patch/efcore-0003-fk-discovery-foreignkeyprops-hashset.patch Normal file
View file

@ -0,0 +1,43 @@
diff --git a/src/EFCore/Metadata/Conventions/ForeignKeyPropertyDiscoveryConvention.cs b/src/EFCore/Metadata/Conventions/ForeignKeyPropertyDiscoveryConvention.cs
index xxxxxxx..xxxxxxx 100644
--- a/src/EFCore/Metadata/Conventions/ForeignKeyPropertyDiscoveryConvention.cs
+++ b/src/EFCore/Metadata/Conventions/ForeignKeyPropertyDiscoveryConvention.cs
@@ -496,14 +496,17 @@ namespace Microsoft.EntityFrameworkCore.Metadata.Conventions;
foreach (var key in dependentEntityType.GetKeys())
{
var isKeyContainedInForeignKey = true;
+ // efcore-0003 fix: build a HashSet once from foreignKeyProperties so that
+ // key.Properties[i] lookup is O(1) instead of O(FK_props) per iteration.
+ // Without fix: O(keys × key_props × fk_props) model-build cost.
+ var foreignKeyPropertySet = foreignKeyProperties != null
+ ? new HashSet<IConventionProperty>(foreignKeyProperties, ReferenceEqualityComparer.Instance)
+ : null;
// ReSharper disable once LoopCanBeConvertedToQuery
// ReSharper disable once ForCanBeConvertedToForeach
for (var i = 0; i < key.Properties.Count; i++)
{
- if (!foreignKeyProperties.Contains(key.Properties[i]))
+ if (foreignKeyPropertySet == null || !foreignKeyPropertySet.Contains(key.Properties[i]))
{
isKeyContainedInForeignKey = false;
break;
}
}
@@ -742,10 +742,13 @@ namespace Microsoft.EntityFrameworkCore.Metadata.Conventions;
public virtual void ProcessKeyAdded(IConventionKeyBuilder keyBuilder, IConventionContext<IConventionKeyBuilder> context)
{
var key = keyBuilder.Metadata;
foreach (var foreignKey in key.DeclaringEntityType.GetDerivedTypesInclusive()
.SelectMany(t => t.GetDeclaredForeignKeys()).ToList())
{
- if (key.Properties.All(p => foreignKey.Properties.Contains(p))
+ // efcore-0003 fix: build HashSet once per foreignKey so key.Properties.All()
+ // is O(key_props) not O(key_props × fk_props).
+ var fkPropsSet = new HashSet<IConventionProperty>(foreignKey.Properties, ReferenceEqualityComparer.Instance);
+ if (key.Properties.All(p => fkPropsSet.Contains(p))
&& (!foreignKey.IsUnique || foreignKey.DeclaringEntityType.BaseType != null))
{
foreignKey.Builder.HasForeignKey((IReadOnlyList<IConventionProperty>?)null);
}
}
}