engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems)

Browse source 
Hibernate (5 HIGH): addColumn/addReferencedColumn/addIndex ArrayList→LinkedHashSet (19x)
  FK second-pass LinkedHashSet, orderHierarchy LinkedHashSet
MyBatis (1 MEDIUM): sortConstructorMappings indexOf→HashMap (12x)
EF Core (2 HIGH + 1 MEDIUM): FindGenerationProperty HashSet (250x),
  AddPrincipals HashSet (250x), FK discovery HashSet (6x)
Diesel (3 MEDIUM): SQLite/MySQL row position()→BTreeMap (51x)
SQLAlchemy (2 HIGH): _values_bindparam Set (500x), evaluated_keys Set (500x)
Peewee (1 MEDIUM): _SortedFieldList.index() bisect (42x)
Sequelize (2 HIGH): bulkInsert Set (50x), expandIncludeAll Set (250x)
TypeORM (3 HIGH): OrmUtils.uniq Map (500x), diffColumns Set (125x),
  updatedColumns Set (100x)
Doctrine ORM (1 HIGH + 2 MEDIUM): hydrator discriminator (26x),
  addSubClass (250x), SqlWalker partial (130x)
GORM (1 MEDIUM): sortCallbacks getRIndex→map (194x)
SQLite: SqliteTest unit proof 4/4 PASS (101x)

Unit tests: all PASS — Hibernate/MyBatis/EfCore/Diesel/SQLAlchemy/Peewee/
  Sequelize/TypeORM/Doctrine/GORM
Whitepaper: 157 sites, 62 ecosystems; PDF 752K
This commit is contained in:
russell@unturf.com 2026-03-27 13:34:26 -04:00
parent db2986ae44
commit d4ed2dff91
49 changed files with 4025 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

20
defects/sequelize/patch/sequelize-0001-bulk-insert-allattributes-set.patch Normal file
View file

@ -0,0 +1,20 @@
diff --git a/packages/core/src/abstract-dialect/query-generator.js b/packages/core/src/abstract-dialect/query-generator.js
--- a/packages/core/src/abstract-dialect/query-generator.js
+++ b/packages/core/src/abstract-dialect/query-generator.js
@@ -346,11 +346,13 @@ class AbstractQueryGenerator {
const tuples = [];
const serials = {};
- const allAttributes = [];
+ // CWE-407 fix: use a Set for O(1) membership test inside the double loop
+ // (for fieldValueHash -> forOwn key) to avoid O(rows * cols^2) complexity.
+ const allAttributesSet = new Set();
+ const allAttributes = [];
let onDuplicateKeyUpdate = '';
for (const fieldValueHash of fieldValueHashes) {
forOwn(fieldValueHash, (value, key) => {
- if (!allAttributes.includes(key)) {
+ if (!allAttributesSet.has(key)) {
+ allAttributesSet.add(key);
allAttributes.push(key);
}

19
defects/sequelize/patch/sequelize-0002-expand-include-all-set.patch Normal file
View file

@ -0,0 +1,19 @@
diff --git a/packages/core/src/model.js b/packages/core/src/model.js
--- a/packages/core/src/model.js
+++ b/packages/core/src/model.js
@@ -515,9 +515,11 @@ class Model {
if (types !== true) {
// replace type placeholder e.g. 'One' with its constituent types
- // CWE-407: all.includes(type_) is O(|all|) inside a for loop = O(n^2)
all.splice(i, 1);
i--;
+ // CWE-407 fix: convert 'all' to a Set for O(1) membership check
+ const allSet = new Set(all);
for (const type_ of types) {
- if (!all.includes(type_)) {
+ if (!allSet.has(type_)) {
all.unshift(type_);
+ allSet.add(type_);
i++;
}
}