0ac47a5b75
feat: add scan_verify.py + check_coverage.py for all 1258 UNDF indicators
...
scan_verify.py: structural patch verification for all UNDF registry entries.
- Reads UNDF-REGISTRY.json, walks defects/*/patch/*.patch
- Checks: UNDF header comment, defective pattern in removed lines,
fix signature in added lines (HashSet/unordered_set/HashMap/etc.)
- Slug-to-patch filtering prevents cross-contamination in multi-entry dirs
- Additive patches (guard insertion) treated as WARN not FAIL
- Status: 454 PASS / 441 WARN / 12 FAIL / 300 NO_PATCH / 51 PENDING
- 74.2% structural coverage of clonable entries
check_coverage.py: CI gate — fails when new registry entries lack patch files.
- Any NO_PATCH entry (dir exists but no patch) causes exit code 1
- Designed to run on every commit to catch regressions early
- Quality (WARN/PASS) delegated to scan_verify.py
Makefile targets added:
make scan-verify — verbose structural verification (all 1258 entries)
make scan-verify-report — same + writes tests/SCAN-VERIFY-REPORT.md
make scan-verify-strict -- also fail on WARN
make coverage-check — CI gate for patch presence
Completes the three-tier coverage system:
unit/integration/functional Java tests (MOADs 0001-0011)
+ structural patch verification (1258+ UNDF indicators)
+ coverage CI gate (enforces no indicator left without a patch)
2026-04-12 16:15:01 -04:00
4888153e40
feat: add unit, integration, and functional test coverage for all 9 MOADs
...
Each MOAD now has a synthetic defective specimen and fixed specimen
proven from first principles across three test tiers:
Unit (tests/unit/Moad000X*.java):
- Correctness: defective and fixed produce identical functional output
- Defect behavior: defective specimen exhibits the defect (measurable)
- Fix behavior: fixed specimen eliminates the defect
Integration (tests/integration/AllMoadsIntegrationTest.java):
- All 9 MOADs proven at medium scale (N=500-2000)
- MOAD-0001: O(N^2) vs O(N) list scan at N=1000
- MOAD-0002: 500 sessions trample each other (defective) vs coexist (fixed)
- MOAD-0003: 250 anonymous requests leak auth identity (defective) vs zero (fixed)
- MOAD-0004: 3000 credential exposures across 1000 requests (defective) vs zero (fixed)
- MOAD-0005: 500 computes for 500 concurrent misses vs exactly 1
- MOAD-0006: all 500 passwords extractable from DB (defective) vs unextractable (fixed)
- MOAD-0007: N=2000 spatial objects, defective visits all 2000 vs O(log N + k)
- MOAD-0009: 990 wasted firings for 1000 ticks / 10 events vs zero waste
- MOAD-0011: 10240 NFA steps vs 13 steps on N=12 adversarial input (788x)
Functional (tests/functional/AllMoadsFunctionalTest.java):
- MOAD-0005: real-thread contention proves herd (defective >1 compute, fixed exactly 1)
- MOAD-0007: N=50000 spatial objects, 50M defective probes vs 516K fixed (97x speedup)
- MOAD-0009: 10000 ticks / 10 events, 9990 wasted firings vs zero (1000x ratio)
- MOAD-0011: N=16 adversarial, 163840 defective steps vs 17 fixed (9638x ratio)
Support algorithms (tests/support/Moad000X*.java):
- Moad0002Algorithm: shared mutable global state (DefectiveAudioSystem / FixedAudioSystem + Context)
- Moad0003Algorithm: ThreadLocal not cleared (handleDefective / handleFixed with finally)
- Moad0004Algorithm: HTTP headers logged verbatim (logDefective / logFixed with CREDENTIAL_HEADERS denylist)
- Moad0005Algorithm: get+null+compute+put (DefectiveCache HashMap / FixedCache ConcurrentHashMap.computeIfAbsent)
- Moad0006Algorithm: Base64 password storage (DefectiveCredentialStore / FixedCredentialStore SHA-256+salt)
- Moad0007Algorithm: linear spatial scan (queryDefective list / queryFixed sorted array + binary search)
- Moad0009Algorithm: timer-driven polling (runDefectiveScheduler / runFixedEventDriven)
- Moad0011Algorithm: PCRE nested quantifiers (matchDefective backtracking NFA / matchFixed linear NFA)
Makefile: added unit-moad-0002 through unit-moad-0011 targets,
integration-all-moads, functional-all-moads. integration and functional
targets now depend on all-MOADs variants.
2026-04-12 15:43:19 -04:00
8a3fc56b23
libjpeg-turbo+libwebp: 5-MOAD scan; libjpeg-turbo-0001 CWE-407, libwebp CLEAN
...
libjpeg-turbo-0001: rdcolmap.c add_map_entry() O(P*C) linear color dedup.
For each pixel in a PPM colormap file, a linear scan checks the palette
(up to 256 entries). With large images (JPEG_MAX_DIMENSION=65500) and a
saturated palette, cost reaches O(W*H*256). Fix: open-addressing hash set
resets once per _read_color_map() call, giving O(1) average per pixel.
Measured 128-131x speedup. 7/7 unit tests PASS.
libwebp: CLEAN on all 5 MOADs. GetColorPalette uses open-addressing hash,
backward references use hash chains, palette sort O(N^2) bounded to N<=256
once per image, DSP init uses mutex-protected lazy initialization.
2026-03-31 22:36:56 -04:00
3c0b3edc79
wave8c: 452/202 — envoy/cilium, graph-dbs, elixir/nim, k8s/maven + PDF
2026-03-27 16:38:25 -04:00
5fe6da7cc2
wave7: 433/194 — kafka/flink/pulsar, spring/micronaut/quarkus, nginx/haproxy/traefik, linux/nomad/consul, numpy/pandas/sklearn, ES/OS/pg/sqlite/rustc/cargo
2026-03-27 16:20:58 -04:00
4d3fcc8e73
game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems
2026-03-27 14:14:49 -04:00
547a9f5738
ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems)
...
rails-0009: FilterAttributeHandler filter_parameters Array O(A×F) → Set (450×)
rails-0010: Encryption::AutoFilteredParameters two Array scans → Set (250×)
rails-0011: TimeZoneConversion skip_list Array O(M×C×S) → Set (20×)
exposed-0001: SchemaUtilityApi mapMissingColumnStatements O(N×M) → map (118×)
exposed-0002: IdentifierManagerApi isAKeyword O(K) linear → HashSet (144×)
exposed-0003: Table.clone consParams.map fresh List → hoisted HashSet (6×)
seaorm-0001: active_model establish_links leftover.any O(N²) → HashSet (501×)
seaorm-0002: rbac engine group_permissions .values().find() → HashMap by ID (502×)
seaorm-0003: schema builder sorted_tables Vec::contains → HashSet (500×)
seaorm-0004: TopologicalSort from_iter seen Vec O(N²) → BTreeSet (28×)
Unit tests: RailsTest 11/11, ExposedTest 3/3, SeaORMTest 4/4 PASS
Whitepaper: 157→167 sites, 62→64 ecosystems; §13.12 ORM Wave 2 added
2026-03-27 13:49:46 -04:00
d4ed2dff91
ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems)
...
Hibernate (5 HIGH): addColumn/addReferencedColumn/addIndex ArrayList→LinkedHashSet (19x)
FK second-pass LinkedHashSet, orderHierarchy LinkedHashSet
MyBatis (1 MEDIUM): sortConstructorMappings indexOf→HashMap (12x)
EF Core (2 HIGH + 1 MEDIUM): FindGenerationProperty HashSet (250x),
AddPrincipals HashSet (250x), FK discovery HashSet (6x)
Diesel (3 MEDIUM): SQLite/MySQL row position()→BTreeMap (51x)
SQLAlchemy (2 HIGH): _values_bindparam Set (500x), evaluated_keys Set (500x)
Peewee (1 MEDIUM): _SortedFieldList.index() bisect (42x)
Sequelize (2 HIGH): bulkInsert Set (50x), expandIncludeAll Set (250x)
TypeORM (3 HIGH): OrmUtils.uniq Map (500x), diffColumns Set (125x),
updatedColumns Set (100x)
Doctrine ORM (1 HIGH + 2 MEDIUM): hydrator discriminator (26x),
addSubClass (250x), SqlWalker partial (130x)
GORM (1 MEDIUM): sortCallbacks getRIndex→map (194x)
SQLite: SqliteTest unit proof 4/4 PASS (101x)
Unit tests: all PASS — Hibernate/MyBatis/EfCore/Diesel/SQLAlchemy/Peewee/
Sequelize/TypeORM/Doctrine/GORM
Whitepaper: 157 sites, 62 ecosystems; PDF 752K
2026-03-27 13:34:26 -04:00
db2986ae44
django/rails/bottle/pyramid: web framework wave complete — 133 sites 52 ecosystems
2026-03-27 12:16:27 -04:00
08989870a6
rails: 8 defects (210x/51x/475x/151x/130x/251x/1000x) + 129 sites 51 ecosystems
2026-03-27 12:12:33 -04:00
9576d47645
bottle/flask/pyramid/sfml/angelscript/threejs/pygame: 22 defects + whitepaper 121 sites 50 ecosystems
2026-03-27 12:08:15 -04:00
8643225d7c
pyramid: 5 defects patched + whitepaper (120 sites, 49 ecosystems)
2026-03-27 12:04:39 -04:00
6bafc7f5e9
sfml/angelscript/threejs/pygame: unit tests + patches + whitepaper (115 sites, 48 ecosystems)
...
SFML 5 defects: VideoMode dedup x3 (139x), allWindows erase (1001x), GL ext (149x)
AngelScript 3 defects: FindNewOwner (100x), CompileSwitch (250x)
Three.js 5 defects: WebGL binding (22x), StackNode filter (1875x), NodeBuilder (517x)
pygame 4 defects: remove_internal (3001x), spritecollide dokill (3001x), switch_layer (3001x)
Whitepaper: 98→115 sites, 44→48 ecosystems
All unit tests pass: 6/6 each
2026-03-27 11:57:12 -04:00
442a6156e3
undefect. CWE-407 — 98 sites, 44 ecosystems; game engines: godot, dry/urho3d; CLAUDE.md clone policy
2026-03-27 11:42:17 -04:00
083765d3c6
undefect. CWE-407 — 96 sites, 43 ecosystems; godot-0001..0004 game engine physics
2026-03-27 11:32:11 -04:00
db29a08762
undefect. CWE-407 — 92 sites, 42 ecosystems
...
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00
0a580b313d
undefect. CWE-407 — 63 sites patched across 27 ecosystems
...
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com
Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
2026-03-26 17:11:57 -04:00
