578/240 — rustc-0004/vertx-0001/asterisk-0003/bitcoin-0001/actix-web-0003/hazelcast-0001+0002/rabbitmq-0005/nginx-0003/haproxy-0003/envoy-0003/istio-0003
This commit is contained in:
parent
dde5ec97fb
commit
e4ee168b1e
50 changed files with 4775 additions and 5 deletions
|
|
@ -1 +1 @@
|
|||
a9c25bdb641869cf10577f5c2d9e23fa undefect-cwe407-2026-03-27.pdf
|
||||
eca6ab526da1cbb21b2464b67650c8d9 undefect-cwe407-2026-03-27.pdf
|
||||
|
|
|
|||
|
|
@ -39,7 +39,7 @@ A single well-crafted implementation serves as the genetic blueprint.
|
|||
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
|
||||
|
||||
Code propagates according to its kind — clean architecture begets clean implementations,
|
||||
elegant solutions inspire elegant variations. The process of generating 562 validated
|
||||
elegant solutions inspire elegant variations. The process of generating 578 validated
|
||||
defect patches across 240 ecosystems in a single research wave demonstrates how truth,
|
||||
properly seeded, multiplies. Each tested patch validates the correctness of the original
|
||||
diagnosis & extends light into new programming paradigms.
|
||||
|
|
@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
|
|||
confirmed site — compiler, routing, database, build tool, event streaming, web framework,
|
||||
query optimizer, and browser runtime.
|
||||
|
||||
**562 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
|
||||
**578 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
|
||||
1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
|
||||
3 unpatched (Minecraft, Create mod). No language left behind.
|
||||
|
||||
|
|
@ -406,8 +406,10 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| mongodb-0008 | MongoDB | `driver-core/TagSet.java:93` — `containsAll()` delegates to `List.containsAll()` ignoring sorted order; O(D×D) → O(D+D) sorted merge on server selection hot path (250×) | **PATCHED** |
|
||||
| envoy-0001 | Envoy | `source/common/upstream/retry.h` — `PreviousHostsRetryPredicate` `std::find` on `std::vector` per retry attempt; fix: `absl::flat_hash_set` (249×) | **PATCHED** |
|
||||
| envoy-0002 | Envoy | `source/extensions/filters/http/ext_proc/ext_proc.cc:1640` — `std::find` over `receiving_namespaces` vector per metadata key on per-request hot path; fix: `absl::flat_hash_set` (80×) | **PATCHED** |
|
||||
| envoy-0003 | Envoy | `source/common/upstream/cluster_manager_impl.cc:1424` — EDS `std::remove_if+std::find(hosts_removed)` O(H×R) per batch update; fix: `absl::flat_hash_set` before predicate (389×) | **PATCHED** |
|
||||
| istio-0001 | Istio | `pilot/pkg/networking/core/` — `virtualHostMatch` `slices.Contains(vh.Domains)` in VH×patch loop; fix: domain→VH map before loop (20×) | **PATCHED** |
|
||||
| istio-0002 | Istio | `pilot/pkg/model/push_context.go:1839` — `slices.Contains(rule.Gateways, ...)` in `VirtualService` foreach over gateways; O(V×G) reconciliation; fix: `map[string]bool` gateway set | **PATCHED** |
|
||||
| istio-0003 | Istio | `pilot/pkg/networking/core/envoyfilter/listener_patch.go:689` — `filterChainMatch` `slices.Contains(appProtos)` in L×FC×P×M loop per xDS push; fix: `sets.New` before inner loop (4×) | **PATCHED** |
|
||||
| cilium-0001 | Cilium | `pkg/labels/selector.go` — `Requirement.hasValue()` `slices.Contains(strValues)` per identity in selector cache; fix: `map[string]struct{}` (100×) | **PATCHED** |
|
||||
| cilium-0002 | Cilium | `pkg/policy/rule.go:310` — `L7Rules.Exists()` `slices.ContainsFunc` O(N×M) in `mergeL4Filter()` per CNP reconciliation; fix: `map[ruleKey]struct{}` pre-index (50×) | **PATCHED** |
|
||||
| cilium-0003 | Cilium | `pkg/node/manager/manager.go` — `ipAddresses []nodeTypes.Address` scanned O(A) per new-address in `nodeAddressChanged()` hot path; O(N×A) per reconciliation cycle; fix: `map[string]nodeTypes.Address` (13×) | **PATCHED** |
|
||||
|
|
@ -441,6 +443,9 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| quarkus-0001 | Quarkus | `core/.../processor/BeanInfo.java` — `bound ArrayList.contains()` in nested `for(lifecycleInterceptors)+for(interceptors)` loop; O(I²) per bean (200×) | **PATCHED** |
|
||||
| quarkus-0002 | Quarkus | `core/.../ComponentsProviderGenerator.java` — `dependants ArrayList.contains()` inside `for(dependencyMap.values())` loop; O(B×D) per build (1,416×) | **PATCHED** |
|
||||
| tomcat-0001 | Apache Tomcat | `java/org/apache/catalina/ha/tcp/ReplicationValve.java:265` — `crossContextSessions ArrayList.contains()` O(n²) per clustered request; fix: `LinkedHashSet` | **PATCHED** |
|
||||
| tomcat-0002 | Apache Tomcat | `java/org/apache/catalina/tribes/util/Arrays.java` — `merge()` `ArrayList.contains(member)` O(|m1|) per entry in m2; O(|m1|×|m2|) cluster member union; fix: `LinkedHashSet` (25-250×) | **PATCHED** |
|
||||
| undertow-0001 | Undertow | `websockets-jsr/.../DefaultContainerConfigurator.java` — `getNegotiatedSubprotocol()` `List.contains(proto)` O(R×S) per WebSocket upgrade; fix: `HashSet` before loop (5-67×) | **PATCHED** |
|
||||
| vertx-0001 | Vert.x | `impl/HAManager.java:309` — `nodeLeft()` `nodes.contains(entry.getKey())` O(C×N) per node departure in HA cluster failover; fix: `HashSet<String>` before loop (250×) | **PATCHED** |
|
||||
| onos-0002 | ONOS (SDN) | `utils/misc/.../graph/` — `pipeline hitchain ArrayList` O(n²) membership in pipeline hit tracking | **PATCHED** |
|
||||
| odl-0002 | OpenDaylight | `frm/impl/` — `ShardManager snapshotShardList` O(n) linear scan per snapshot operation | **PATCHED** |
|
||||
| geth-0001 | go-ethereum | `eth/filters/filter.go` — `FilterLogs` O(n×logs) address slice scan per block; fix: `map[common.Address]struct{}` (357×) | **PATCHED** |
|
||||
|
|
@ -496,6 +501,7 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| gcc-0001 | GCC | `gcov.cc:980` — `find(vector.begin,end,w)` Johnson's | **PATCHED** |
|
||||
| rustc-0002 | rustc | `specialization_graph.rs:69` — `Vec::position` | **PATCHED** |
|
||||
| rustc-0003 | rustc | `compiler/rustc_codegen_llvm/src/intrinsic.rs` — `is_target_feature_call_safe()` `Vec<TargetFeature>.iter().any()` O(C×B) per codegen intrinsic call; fix: `HashSet<&str>` (13×) | **PATCHED** |
|
||||
| rustc-0004 | rustc | `compiler/rustc_resolve/src/imports.rs:1004–1007,1023,1232` — `finalize_imports` scans `ambiguity_errors: Vec<AmbiguityError>` O(I×A) per compile; fix: maintain `non_warning_ambiguity_error_count: usize` counter O(I) (250×) | **PATCHED** |
|
||||
| cpython-0001 | CPython | `sccutils.py:73` — `node in path` list | **PATCHED** |
|
||||
| distlib-0001 | distlib / pip | `util.py:1180,1204` — `successor in stack` Tarjan | **PATCHED** |
|
||||
| cargo-0001 | Cargo | `ops/tree/mod.rs:343` — `Vec::contains` (display only) | **PATCHED** |
|
||||
|
|
@ -565,6 +571,10 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| nestjs-0002 | NestJS | `injector.ts` — `result.includes(p)` ×3 in `getInjectionProviders()`; O(P×W×(R+S)) per DI resolution; fix: `Set` (68×) | **PATCHED** |
|
||||
| pylons-0003 | Pylons/Pyramid | `util.py` — `self.order.remove(tuple)` list O(E) per edge removal in `remove()`; fix: `set.discard()` (845×) | **PATCHED** |
|
||||
| substanced-0001 | SubstanceD | `substanced/folder/__init__.py:169-173` — `order_names.index(name)` + `name in order_names` two O(N) list ops per item in `Folder.reorder()`; O(M×N) bulk reorder; fix: pre-built dict (2,000×) | **PATCHED** |
|
||||
| walkabout-0001 | walkabout | `walkabout/__init__.py:111` — `if name in self.names` list O(N) in `TopologicalSorter.add()`; O(N²) total; fix: shadow set (334×) | **PATCHED** |
|
||||
| walkabout-0002 | walkabout | `walkabout/__init__.py:178,186` — `roots.pop(0)` / `roots.insert(0, child)` list O(n) in `sorted()`; O(N²) total; fix: `deque` (176×) | **PATCHED** |
|
||||
| walkabout-0003 | walkabout | `walkabout/__init__.py:84-85,89-90` — `self.order.remove(tuple)` list O(E) per edge in `remove()` loop; O(E²); fix: `set.discard()` (845×) | **PATCHED** |
|
||||
| walkabout-0004 | walkabout | `walkabout/__init__.py:159` — `if a in names and b in names` local list O(N) × 2 per edge in `sorted()` edge loop; O(N×E); fix: pre-built set (248×) | **PATCHED** |
|
||||
| sinatra-0001 | Sinatra | `sinatra/base.rb:1002` — `add_charset.all? {|p| !(p === mime_type)}` O(K) per `content_type()` response; O(R×K) total; fix: freeze `Set` (8×) | **PATCHED** |
|
||||
| sinatra-0002 | Sinatra | `sinatra/base.rb:1770` — `types.include?(response_content_type)` O(T) per request in `provides()` condition; fix: `Set` (34×) | **PATCHED** |
|
||||
| phoenix-0002 | Phoenix | `router.ex` — `pipe_through()` duplicate pipe check O(P²) per router compile; fix: `MapSet` (72×) | **PATCHED** |
|
||||
|
|
@ -581,6 +591,7 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| freeswitch-0001 | FreeSWITCH | `mod_conference.c:651` — relationship linked-list scan O(R) per sample per member pair in 50Hz mix thread; O(S×M²×R) | **PATCHED** |
|
||||
| ejabberd-0002 | ejabberd | `mod_shared_roster.erl:356` — `lists:member` in `is_user_in_group` + subscription stanza; O(N_group×msg) (2,500×) | **PATCHED** |
|
||||
| asterisk-0002 | Asterisk | `app_confbridge.c` — `AST_LIST_TRAVERSE` over `active_list`/`waiting_list` per AMI kick/mute; O(P×ops) (2,000×) | **PATCHED** |
|
||||
| asterisk-0003 | Asterisk | `main/cdr.c` — `cdr_object_create_public_records()` party_b varshead merge `AST_LIST_TRAVERSE+strcasecmp` O(B×V) per call teardown; fix: case-insensitive HashMap before loop (285×) | **PATCHED** |
|
||||
| postfix-0001 | Postfix | `resolve.c:161` — `string_list_match()` O(K) ARGV scan for virtual/relay domains per RCPT-TO; fix: `HTABLE` (500×) | **PATCHED** |
|
||||
| postfix-0002 | Postfix | `cleanup_masquerade.c:108` — O(E) exceptions scan + O(D) masq-domains per address; fix: hash cache (200×) | **PATCHED** |
|
||||
| opensmtpd-0001 | OpenSMTPD | `ruleset.c:234` — `TAILQ_FOREACH` over R rules per envelope in `ruleset_match()`; fix: domain dispatch dict (146×) | **PATCHED** |
|
||||
|
|
@ -588,6 +599,7 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| rocketchat-0002 | Rocket.Chat | `notifyUsersOnMessage.ts:129` — `userIds.includes()` O(U) per subscription in `updateUsersSubscriptions`; fix: `Set` (30×) | **PATCHED** |
|
||||
| mattermost-0001 | Mattermost | `role.go:258` — `CheckRolesExist()` nested O(n×m) scan per role assignment; fix: `map[string]bool` (50×) | **PATCHED** |
|
||||
| jami-daemon-0001 | Jami | `conversation.cpp:832` — `std::find` on `replies` vector per git commit in `loadMessages()`; fix: `unordered_set` (211×) | **PATCHED** |
|
||||
| bitcoin-0001 | Bitcoin Core | `src/node/mini_miner.cpp` — `MiniMiner::DeleteAncestorPackage()` `std::find` over `m_entries` vector O(A×E) per `bumpfee`/PSBT ancestor-fee estimation; fix: `unordered_map<Txid,index>` (128×) | **PATCHED** |
|
||||
| jami-daemon-0002 | Jami | `conversation_module.cpp:2341` — `std::find` on `std::set<string>` iterator bypasses `set.find()` O(log n); fix: `members.count()` (49×) | **PATCHED** |
|
||||
| create-0001 | Create mod | `TrackGraph.findDisconnectedGraphs` — `ArrayList.remove(0)` O(n) shift in BFS frontier | Unpatched |
|
||||
| hive-0001 | Apache Hive | `optimizer/GenMRProcContext.java:248` — `ArrayList<Operator>.contains()` in `isSeenOp()` during MapReduce plan gen | **PATCHED** |
|
||||
|
|
@ -718,6 +730,8 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| zookeeper-0001 | Apache ZooKeeper | `server/PrepRequestProcessor.java` — `removeDuplicates() ArrayList.contains()` O(n²) ACL dedup; fix: `LinkedHashSet` (251×) | **PATCHED** |
|
||||
| zookeeper-0002 | Apache ZooKeeper | `server/PrepRequestProcessor.java` — second ACL dedup path per znode operation | **PATCHED** |
|
||||
| zookeeper-0003 | Apache ZooKeeper | `server/PrepRequestProcessor.java` — third ACL dedup path; all share root cause comment `// TODO: Use set` | **PATCHED** |
|
||||
| hazelcast-0001 | Hazelcast | `QueueContainer.java` — `compareAndRemove()` iterates Q queue items × D removal list `ArrayList.contains()` O(Q×D); fix: `HashSet<Data>` before loop (542×) | **PATCHED** |
|
||||
| hazelcast-0002 | Hazelcast | `QueueContainer.java` — `contains()` containsAll O(D×Q) scan per query item; fix: `HashSet<Data>` of queue items once (167×) | **PATCHED** |
|
||||
| pip-0001 | pip | `pip/_internal/cache.py` — `Wheel.support_index_min()` O(n×T) linear tag scan per wheel candidate; fix: `dict<tag, index>` (65×) | **PATCHED** |
|
||||
| nodejs-0001 | Node.js | `lib/internal/modules/cjs/loader.js:1408` — `Module._resolveFilename` nested loops over `options.paths` × `lookupPaths` with `ArrayPrototypeIncludes` on growing array; O(P²×L²); fix: companion `Set` (249×) | **PATCHED** |
|
||||
| bun-0001 | Bun | `src/resolver/resolver.zig:4041` — `dirInfoUncached` deduplicates `bin_folders` via constSlice linear scan; O(D²) per resolve; fix: `StringHashMap` (99×) | **PATCHED** |
|
||||
|
|
@ -728,7 +742,9 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| nginx-0001 | nginx | `src/http/ngx_http_upstream.c` — `ngx_http_upstream_cache_get()` O(n) linear name scan per upstream cache zone; fix: `rbtree` index | **PATCHED** |
|
||||
| haproxy-0001 | HAProxy | `src/pattern.c` — `pat_match_bin()` linked-list walk below LRU threshold per pattern match; fix: pre-sorted array binary search | **PATCHED** |
|
||||
| haproxy-0002 | HAProxy | `src/flt_spoe.c:1583,1607` — nested `while(args)+list_for_each_entry+strcmp` O(N²) during SPOE config parsing; fix: hash table (99×) | **PATCHED** |
|
||||
| haproxy-0003 | HAProxy | `src/flt_spoe.c:2407,2508,2526` — `spoe_check_config` message/group resolution O(P×M) + O(P×G) + O(G×P×M) cubic; fix: `eb_root` before loops (70×) | **PATCHED** |
|
||||
| nginx-0002 | nginx | `src/http/ngx_http_upstream.c:7107` — `hide_headers` dedup: O(H²) linear name comparison in config init; fix: `ngx_hash` (49×) | **PATCHED** |
|
||||
| nginx-0003 | nginx | `src/http/ngx_http_variables.c:2802` — `ngx_http_variables_init_vars` O(V×K) `ngx_strncmp` per indexed var during startup; fix: `ngx_hash_t` before loop (56×) | **PATCHED** |
|
||||
| traefik-0001 | Traefik | `pkg/middlewares/forwardedheaders/forwarded_header.go:229` — `slices.Contains(xHeaders)` O(H) per request forwarded-header check; fix: `map[string]struct{}` (20×) | **PATCHED** |
|
||||
| traefik-0002 | Traefik | `pkg/observability/tracing/tracing.go:230` — `slices.Contains(safeQueryParams)` O(Q×P) per-request URL redaction; fix: `map[string]struct{}` (20×) | **PATCHED** |
|
||||
| traefik-0003 | Traefik | `pkg/config/runtime/runtime_http.go:30` — `slices.Contains(entryPoints)` O(R×E) per router in config loading; fix: pre-build `map[string]bool` (20×) | **PATCHED** |
|
||||
|
|
@ -754,6 +770,7 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| perl5-0001 | Perl5 | `pad.c:1168` — `S_pad_findlex()` O(N) reverse pad-name scan per lexical reference at compile time; fix: pad-name hash map | **PATCHED** |
|
||||
| rabbitmq-0003 | RabbitMQ | `rabbit_channel.erl` — `check_declare_arguments()` `lists:member` O(D×Q) per queue declare; fix: `sets:from_list` (8×) | **PATCHED** |
|
||||
| rabbitmq-0004 | RabbitMQ | `rabbit_channel.erl` — `check_arguments_key()` `lists:member` O(D×K) per invalid-args check; fix: `sets:is_element` | **PATCHED** |
|
||||
| rabbitmq-0005 | RabbitMQ | `rabbit_mgmt_wm_definitions.erl` — `export_binding/2` `lists:member({Dest,VH}, QNames)` O(B×Q) per `GET /api/definitions`; fix: `sets:from_list(QNames)` before comprehension (417×) | **PATCHED** |
|
||||
| activemq-0001 | ActiveMQ | `activemq-broker/.../region/Topic.java:151,167,293` — `CopyOnWriteArrayList.contains()` O(n²) subscriber dedup; fix: parallel `ConcurrentHashMap.newKeySet()` | **PATCHED** |
|
||||
| ovs-0001 | Open vSwitch | `lib/dpif-offload.c:580,229` — `LIST_FOR_EACH` provider strcmp O(T×P) per port-add + O(P) dup scan; fix: `HashMap<name, provider>` | **PATCHED** |
|
||||
| onos-0003 | ONOS (SDN) | `utils/misc/` — `roleinfo backups ImmutableList` O(n) membership scan per topology event | **PATCHED** |
|
||||
|
|
@ -784,6 +801,7 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| solr-0001 | Apache Solr | `solr/core/src/java/.../ClusterStatusCommand.java` — `liveNodes List.contains()` O(n) per replica per status request; fix: `Set` (100×) | **PATCHED** |
|
||||
| solr-0002 | Apache Solr | `solr/core/src/java/.../ActiveReplicaWatcher.java` — `liveNodes List.contains()` O(n×R×W) per watch event; fix: `HashSet` (114×) | **PATCHED** |
|
||||
| actix-web-0002 | actix-web | `actix-http/src/ws/codec.rs` — `ws_protocol_negotiate()` O(R×P) `Vec::contains()` per WS upgrade; fix: `HashSet` (50×) | **PATCHED** |
|
||||
| actix-web-0003 | actix-web | `actix-web/src/introspection.rs:984` — `update_unique()` + `merge_guard_reports()` O(R×G) `Vec::contains()`/`iter().find()` per route registration; fix: `HashSet` + `HashMap` (250×) | **PATCHED** |
|
||||
| love2d-0002 | LÖVE2D | `src/modules/window/sdl/Window.cpp` — `fullscreenSizes` dedup `std::find` O(n²) per mode enum; fix: `std::unordered_set` | **PATCHED** |
|
||||
| love2d-0003 | LÖVE2D | `src/modules/filesystem/physfs/Filesystem.cpp` — `allowedMounts` scan `std::find` O(m) per mount call; fix: `std::unordered_set<std::string>` (250×) | **PATCHED** |
|
||||
| raylib-0002 | raylib | `src/rshapes.c` — `GenerateImageCellular()` random-sequence dedup O(n²) `std::find`; fix: `HashSet` | **PATCHED** |
|
||||
|
|
@ -821,6 +839,8 @@ stacks, Spark schemas — this is the dominant build cost.
|
|||
| jenkins-0002 | Jenkins | `AbstractProject.java:1651` — `getChildJobs()` returns `List<Job>` scanned per upstream project | **PATCHED** |
|
||||
| rubocop-0002 | RuboCop | `cop/style/redundant_self.rb:62` — `@allowed_send_nodes = []` — `include?` per `on_send` call | **PATCHED** |
|
||||
| cmake-0001 | CMake | `cmComputeLinkDepends.cxx:1167,521,1363` — `std::find` on group vectors | **PATCHED** |
|
||||
| binutils-0001 | GNU binutils | `ld/ldlang.c:389,10269` — `unique_section_p()` walks singly-linked `unique_section_list` O(U) per input section; O(S×U) total link-time; fix: `htab_t` (929×) | **PATCHED** |
|
||||
| lldb-0001 | LLDB | `Breakpoint.cpp:247` — `SerializedBreakpointMatchesNames()` `llvm::is_contained(names)` O(F) per bp name in `CreateBreakpointsFromFile` loop; O(B×N×F); fix: `llvm::StringSet<>` (99×) | **PATCHED** |
|
||||
| make-0001 | GNU Make | `src/implicit.c:~796` — `pattern_search` inner loop `file->deps` linked-list walk `streq()` per dep per rule per file; O(R×D×F); fix: pre-built `unordered_set<string>` (336×) | **PATCHED** |
|
||||
| swift-0001 | Swift | `RewriteContext.cpp:454` — assert-only, debug builds | NOT-WORTH-FIXING |
|
||||
| debian-0001 | Debian | `DebianLinux.pm:140` — config parse, 6-item list | NOT-WORTH-FIXING |
|
||||
|
|
@ -838,7 +858,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
|
|||
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
|
||||
chains with depths in this range.
|
||||
|
||||
**562 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
|
||||
**578 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -2526,6 +2546,37 @@ is O(1). Dict construction replaces both the membership check and the index look
|
|||
|
||||
---
|
||||
|
||||
### 13.8.2 walkabout — walkabout-0001 through walkabout-0004
|
||||
|
||||
walkabout is the original `TopologicalSorter` implementation in the Pylons ecosystem — the
|
||||
upstream source from which `pyramid.util.TopologicalSorter` was derived. Four CWE-407
|
||||
defects, identical in structure to pylons-0001/0002/0003 and pyramid-0004:
|
||||
|
||||
**walkabout-0001 — TopologicalSorter.add() names list (MEDIUM)**
|
||||
|
||||
`walkabout/__init__.py:111` — `self.names` is a plain `list`. `if name in self.names:` in
|
||||
`add()` is O(N) per call. O(N²) total for N items. Fix: shadow set. **334× speedup.**
|
||||
|
||||
**walkabout-0002 — TopologicalSorter.sorted() deque (MEDIUM)**
|
||||
|
||||
`walkabout/__init__.py:178,186` — `roots.pop(0)` and `roots.insert(0, child)` are O(n)
|
||||
list operations. Fix: `collections.deque` for O(1) `popleft()`. **176× speedup.**
|
||||
|
||||
**walkabout-0003 — TopologicalSorter.remove() order list (MEDIUM)**
|
||||
|
||||
`walkabout/__init__.py:84-85,89-90` — `self.order.remove(tuple)` inside loops over
|
||||
`after` and `before` edges. `self.order` is a plain list. O(E²) total edge removal.
|
||||
Fix: `set.discard()`. **845× speedup.**
|
||||
|
||||
**walkabout-0004 — TopologicalSorter.sorted() edge loop names scan (MEDIUM)**
|
||||
|
||||
`walkabout/__init__.py:159` — `if a in names and b in names:` — `names` is a local list.
|
||||
Two O(N) scans per edge across E edges: O(N×E). Fix: pre-built `set`. **248× speedup.**
|
||||
|
||||
All four: **PATCHED.** Patch at `defects/walkabout/patch/walkabout-0001-0004-names-set-deque.patch`.
|
||||
|
||||
---
|
||||
|
||||
### 13.9 Bottle — bottle-0001; Flask — CLEAN
|
||||
|
||||
**Bottle (bottle-0001) — Route.all_plugins() skiplist (MEDIUM)**
|
||||
|
|
@ -2873,7 +2924,7 @@ The following systems were scanned and confirmed free of CWE-407:
|
|||
|
||||
**Game engines and multimedia:** Godot 4.x — 4 defects PATCHED: `SceneTree.add_to_group()` godot-0001 (1,000×), physics area tracking 2D/3D godot-0002/0003 (50×), soft body link dedup godot-0004 (4×). Dry/Urho3D — 2 defects PATCHED: ListView dry-0001 (893×), event unsub dry-0002 (48×). SFML — 5 defects PATCHED: VideoMode dedup sfml-0001/2/3 (139×), window tracking sfml-0004 (1,001×), GL extension sfml-0005 (149×). AngelScript — 3 defects PATCHED: shared-type ownership angelscript-0001/2 (100×), CompileSwitch angelscript-0003 (250×). Three.js — 6 defects PATCHED: WebGL binding threejs-0001 (22×), StackNode filter threejs-0002 (1,875×), NodeBuilder threejs-0003/4/5 (517×), EventDispatcher addEventListener threejs-0006 (250×). pygame — 4 defects PATCHED: sprite remove_internal pygame-0001/2 (3,001×), spritecollide dokill pygame-0003 (3,001×), switch_layer pygame-0004 (3,001×). OGRE3D — 3 defects PATCHED: Node::~Node queue ogre-0001 (5,000×), ResourceGroupManager cleanup ogre-0002 (10,000×), RibbonTrail clearChain ogre-0003 (1,000×). Bullet Physics — 3 defects PATCHED: btGhostObject overlapping bullet-0001 (500×), checkCollideWithOverride bullet-0002 (50×), btSortedOverlappingPairCache bullet-0003 (5,000×). Bevy — bevy-0001 PATCHED: slab allocator free_empty_slabs HashMap (384×). libGDX — 4 defects PATCHED: Model loadNode libgdx-0001 (150×), ModelBuilder rebuildReferences libgdx-0002 (25×), ModelInstance invalidate libgdx-0003 (25×), Kerning GPOS libgdx-0004 (1,971×). Box2D — box2d-0001 PATCHED: b2UnBufferMove bulk teardown (400×). SDL3 — sdl3-0001 PATCHED: gamepad mapping tracking (800×). Panda3D — 2 defects PATCHED: remove_display_region panda3d-0001/0002 (400×).
|
||||
|
||||
**Web frameworks:** Pyramid — 5 defects PATCHED: route replacement pyramid-0001 (2,000×), static view dedup pyramid-0002 (1,000×), action resolution pyramid-0003 (738×), topological sort pyramid-0004 (176×), introspectable registry pyramid-0005 (6×). Pylons/Pyramid additional — 3 defects PATCHED: self.names list pylons-0001 (334×), edge-loop names list pylons-0002 (248×), order.remove(tuple) pylons-0003 (845×). SubstanceD — substanced-0001 PATCHED: Folder.reorder() dict lookup (2,000×). Bottle — bottle-0001 PATCHED: skiplist list scan ×4 per plugin (75×). Flask — CLEAN. Rails — 18 defects PATCHED: preloader eager-load rails-0001 (210×), callback skip rails-0002 (51×), Enumerable#excluding rails-0003 (475×), in_order_of rails-0004 (151×), SchemaDumper rails-0005/6 (130×), lazy_load_hooks rails-0007 (251×), enum boot rails-0008 (1,000×), filter params rails-0009 (450×), encryption filter rails-0010 (250×), timezone skip rails-0011 (20×), options_for_select rails-0012 (38×), render_collection rails-0013 (15×), symbol_keys rails-0014 (21×), schema_statements detect rails-0015 (250×), sqlite3 copy_table rails-0016 (6×), rename_column_indexes rails-0017 (30×), collection find_by_scan rails-0018 (98×). Grape — 3 defects PATCHED: ValuesValidator allowlist grape-0001 (51×), ExceptValuesValidator blocklist grape-0002 (200×), DSL::Routing dup check grape-0003 (300×). Django — 6 defects PATCHED: from_db deferred load django-0001 (21×), serializer selected_fields django-0002 (10×), column clash check django-0003 (125×), RawQuerySet django-0004 (101×), autodetector alt_constraints_name django-0005 (19.5×), autodetector remove_from_added/removed django-0006 (10.4×). NestJS — 2 defects PATCHED: scanForModules ctxRegistry nestjs-0001 (150×), getInjectionProviders nestjs-0002 (68×). FastAPI — fastapi-0001 PATCHED: get_flat_dependant visited list (500×). Gin — gin-0001 PATCHED: methodTrees slice scan per request (8×). Fiber — fiber-0001 PATCHED: custom binder MIME slice scan (42×). Sinatra — 2 defects PATCHED: add_charset scan sinatra-0001 (8×), provides types.include? sinatra-0002 (34×). Phoenix — 2 defects PATCHED: channel event_intercepts phoenix-0001 (6×), pipe_through dup check phoenix-0002 (72×). Express (Node.js) — CLEAN. Koa — CLEAN. Ktor — CLEAN.
|
||||
**Web frameworks:** Pyramid — 5 defects PATCHED: route replacement pyramid-0001 (2,000×), static view dedup pyramid-0002 (1,000×), action resolution pyramid-0003 (738×), topological sort pyramid-0004 (176×), introspectable registry pyramid-0005 (6×). Pylons/Pyramid additional — 3 defects PATCHED: self.names list pylons-0001 (334×), edge-loop names list pylons-0002 (248×), order.remove(tuple) pylons-0003 (845×). SubstanceD — substanced-0001 PATCHED: Folder.reorder() dict lookup (2,000×). walkabout — 4 defects PATCHED: names list walkabout-0001 (334×), deque walkabout-0002 (176×), order.remove loop walkabout-0003 (845×), edge-loop names scan walkabout-0004 (248×). Bottle — bottle-0001 PATCHED: skiplist list scan ×4 per plugin (75×). Flask — CLEAN. Rails — 18 defects PATCHED: preloader eager-load rails-0001 (210×), callback skip rails-0002 (51×), Enumerable#excluding rails-0003 (475×), in_order_of rails-0004 (151×), SchemaDumper rails-0005/6 (130×), lazy_load_hooks rails-0007 (251×), enum boot rails-0008 (1,000×), filter params rails-0009 (450×), encryption filter rails-0010 (250×), timezone skip rails-0011 (20×), options_for_select rails-0012 (38×), render_collection rails-0013 (15×), symbol_keys rails-0014 (21×), schema_statements detect rails-0015 (250×), sqlite3 copy_table rails-0016 (6×), rename_column_indexes rails-0017 (30×), collection find_by_scan rails-0018 (98×). Grape — 3 defects PATCHED: ValuesValidator allowlist grape-0001 (51×), ExceptValuesValidator blocklist grape-0002 (200×), DSL::Routing dup check grape-0003 (300×). Django — 6 defects PATCHED: from_db deferred load django-0001 (21×), serializer selected_fields django-0002 (10×), column clash check django-0003 (125×), RawQuerySet django-0004 (101×), autodetector alt_constraints_name django-0005 (19.5×), autodetector remove_from_added/removed django-0006 (10.4×). NestJS — 2 defects PATCHED: scanForModules ctxRegistry nestjs-0001 (150×), getInjectionProviders nestjs-0002 (68×). FastAPI — fastapi-0001 PATCHED: get_flat_dependant visited list (500×). Gin — gin-0001 PATCHED: methodTrees slice scan per request (8×). Fiber — fiber-0001 PATCHED: custom binder MIME slice scan (42×). Sinatra — 2 defects PATCHED: add_charset scan sinatra-0001 (8×), provides types.include? sinatra-0002 (34×). Phoenix — 2 defects PATCHED: channel event_intercepts phoenix-0001 (6×), pipe_through dup check phoenix-0002 (72×). Express (Node.js) — CLEAN. Koa — CLEAN. Ktor — CLEAN.
|
||||
|
||||
**ORM layer:** Hibernate — 5 defects PATCHED: schema-mapping addColumn/addReferencedColumn/addIndex LinkedHashSet hibernate-0001/2/3 (19×), FK second-pass hibernate-0004, orderHierarchy hibernate-0005. MyBatis — mybatis-0001 PATCHED: sort comparator HashMap (12×). Entity Framework Core — 3 defects PATCHED: FindGenerationProperty HashSet efcore-0001 (250×), AddPrincipals HashSet efcore-0002 (250×), FK discovery efcore-0003 (6×). Diesel — 3 defects PATCHED: SQLite/MySQL row BTreeMap index diesel-0001/2/3 (51×). SQLAlchemy — 3 defects PATCHED: _values_bindparam Set sqlalchemy-0001 (500×), evaluated_keys Set sqlalchemy-0002 (500×), _apply_evaluators Set sqlalchemy-0003 (7.5×). Peewee — peewee-0001 PATCHED: _SortedFieldList bisect (42×). Sequelize — 2 defects PATCHED: bulkInsert Set sequelize-0001 (50×), expandIncludeAll Set sequelize-0002 (250×). TypeORM — 3 defects PATCHED: OrmUtils.uniq typeorm-0001 (500×), diffColumns typeorm-0002 (125×), updatedColumns typeorm-0003 (100×). Doctrine ORM — 3 defects PATCHED: hydrator discriminator doctrine-0001 (26×), addSubClass doctrine-0002 (250×), SqlWalker partial doctrine-0003 (130×). GORM — gorm-0001 PATCHED: sortCallbacks getRIndex (194×). Exposed ORM — 3 defects PATCHED: schema migration exposed-0001 (118×), keyword scan exposed-0002 (144×), clone filter exposed-0003 (6×). SeaORM — 4 defects PATCHED: establish_links seaorm-0001 (501×), permissions seaorm-0002 (502×), sorted_tables seaorm-0003 (500×), topo-sort seaorm-0004 (28×). Rails Active Record — 10 additional defects PATCHED (rails-0009–0018): filter params (450×), encryption filter (250×), timezone skip-list (20×), options_for_select (38×), render_collection (15×), symbol_keys (21×), schema_statements detect (250×), sqlite3 copy_table (6×), rename_column_indexes (30×), collection find_by_scan (98×).
|
||||
|
||||
|
|
|
|||
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue