Both were flagged in Wave 17 survey as borderline real defects deferred
for follow-up because the fix needed careful design beyond a single-line
set hoist. Both shipped now with full bench + ticket + intel.
UNDF-1310 symfony-0001 (HIGH) - PropertyAccessor::writeCollection.
Doctrine entity collection diff: in_array($item, $collection, true)
per item in $previousValue, then in_array($item, $previousValue, true)
per item in $collection. O(P*C). Fix: dual lookup
(SplObjectStorage for objects + serialize-keyed array for scalars,
in_array fallback for resources). Bench: 5.2x at P=C=100,
88x at P=C=2000.
UNDF-1311 pyright-0001 (HIGH) - CallHierarchyProvider outgoing/incoming
call dedup. _outgoingCalls.find / _incomingCalls.find with composite
key (uri, range) walks the list per call expression. O(C^2). Fix:
parallel Map<string, entry> keyed by composite serialized form
(uri|start.line|start.char|end.line|end.char). Bench: 2.7x at C=100,
22x at C=2000.
Total session flagships: 11 (was 9) — 7 CWE-407 + 3 MOAD-0003 + 1 MOAD-0004.
Wave 17 borderline backlog now empty.
Acting on the 4 borderline candidates flagged in the session-summary intel.
All 4 surfaced after the unmoad scanner enhancements cleared M3/M4 noise.
UNDF-1306 wildfly-0002 (HIGH) - ElytronSecurityDomainContextImpl.isValid()
sets currentIdentity ThreadLocal with no paired cleanup contract. Subject
populated at line 69 is the canonical handover; the ThreadLocal stash leaks
to next request on the pool thread. Fix: drop the .set(identity) line.
UNDF-1307 wildfly-0003 (LOW) - TransactionRollbackSetupAction.depth.set(null)
should be depth.remove() to fully delete the ThreadLocal entry; current
pattern leaves null binding pinning the WildFly classloader during
undeploy/redeploy. Functional clear, classloader-retention only.
UNDF-1308 log4j2-0001 (HIGH) - Log4jMDCAdapter.clear() only clears the
log4j ThreadContext map, NOT the SLF4J pushByKey/popByKey stacks
(mapOfStacks ThreadLocal). SLF4J spec mandates clear() means "clear
all MDC". Per-key Deques accumulate across requests. Fix: add clear()
to ThreadLocalMapOfStacks (calls tlMapOfStacks.remove()) and call from
the public clear().
UNDF-1309 nakama-0001 (HIGH MOAD-0004) - social/social.go logs OAuth
access tokens, ID tokens, oauth2.Token objects (incl. refresh tokens),
Steam publisherKey + ticket at debug level via zap.String/zap.Any.
11 call sites. Fix: replace value-logging with shape-logging (token_len,
has_token bool) — preserves debug value, redacts secret bytes.
First MOAD-0004 patch this session. Companion to the 3 MOAD-0003 patches
(wildfly-0001/0002/0003) extending the inverse-pipeline pattern across
projects: scanner enhancement -> noise reduction -> human triage finds
defects that were buried.
Total session flagships: 9 (was 6) — 5 CWE-407 + 3 MOAD-0003 + 1 MOAD-0004.
First MOAD-0003 (Leaked Context) flagship this session. Surfaced via
scanner enhancement: commit 1f48798 (Java ThreadLocal-scoped .set fix)
dropped wildfly M3 noise from 4840 -> 37, exposing this real defect.
Defect: ElytronSecurityIntegration.java:38 declares
private final ThreadLocal<SecurityContext> securityContext = new ThreadLocal<>();
with setSecurityContext() calling .set(context) and ZERO corresponding
.remove() / .set(null) anywhere in the WildFly codebase (verified by
grep -rn). JCA WorkManager reuses pool threads across Work items from
different security principals; a leftover SecurityContext from prior
Work is visible to any subsequent Work that reads getSecurityContext()
before installing its own — which WildflyWorkWrapper.runWork() does
exactly to decide whether to use Elytron-runWork or super.runWork().
Fix: 2-file surgical patch (no SPI change):
1. setSecurityContext(null) now calls .remove() (clear ThreadLocal,
prevent classloader retention)
2. WildflyWorkWrapper.runWork() wraps body in try/finally that calls
setSecurityContext(null) after the Work item completes
This is the inverse pipeline from CWE-407 flagships: scanner improved
its signal-to-noise so triage could find what raw scanning could not
have ranked.
Three coupled defects in RTTIGccClassRecoverer:
1. isPossibleVttStart REBUILDS vtableAndVftableAddrs on every call (O(V) waste)
2. getVttAddresses calls it inside outer while loop (multiplies the rebuild)
3. addPointerToList uses List<Address>.contains for membership (O(V) per check)
Fix: hoist Set<Address> once, pass to isPossibleVttStart, eliminate per-call rebuild.
ghidra-0001 covers RecoveredClassHelper (MSVC + gcc) — the foundation pattern.
ghidra-0002 covers gcc-specific VTT recovery — extends coverage to Linux C++ binaries.
Together: ghidra C++ class recovery drops from seconds-to-minutes to milliseconds.
Flagship: weaviate authorization filter slices.Contains per item (O(N*K)).
Multi-tenant deployments with hundreds-thousands of permitted resources pay
this on every authorized read. Set hoist: 1735x speedup at N=50k K=5k.
Wave 11 honor roll: bash, coreutils. Cumulative: 49 projects.
The Gatsby authors annotated each of the three call sites in
in-memory/indexing.ts with 'expensive at scale' comments. Their
diagnosis is correct: nodeTypeNames.includes(node.internal.type)
inside iterateNodes().forEach is O(N*T) per cache build.
For N=100k+ nodes typical of mature content sites and T=10-30
declared types per query, this fires on every type-filtered query.
gatsby develop in particular rebuilds caches per page render.
Fix: hoist Set<string> once at the top of each function. O(1) per
node lookup. Total cost O(N+T). Bench shows 8.4x at N=100k T=50;
2.7-4.7x at smaller scales.
Three call sites patched: ensureIndexByElemMatch (line 326),
ensureEmptyFilterCache (378), ensureIndexByElemMatchValue (504).
Author 'expensive at scale' comments updated to record the fix.
testcafe-0001: Selector filterNodes (string-filter branch) and
expandSelectorResults both dedup via Array.indexOf on growing result
arrays. filterNodes: O(N*M) per selector filter. expandSelectorResults:
O(N^2 * K^2) worst case when derivatives unique. Fix: Set<Node> keyed
by object identity. Bench: 398x at N=2000 filter, 1966x at N=K=150
expand.
webdriverio-0002: MSPO aggregator dedups per-test entries via Array.find
on growing bucket array. O(N^2) per test bucket, same pattern repeats
in unknown-suite merger. Fix: companion Map<bucketKey, Set<selector>>
for O(1) dedup. Bench: 493x at N=2000.
UNDF IDs: 1290 (testcafe), 1291 (webdriverio-0002). All 17 tests pass.
Salt pcre/grain_pcre targeting passes user-controlled regex to re.match/re.compile
without timeout. Ansible inventory manager passes tilde-prefixed host patterns
directly to re.compile. Both fixed with ThreadPoolExecutor 1s timeout wrapper.
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.
Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.
Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.
Strategy: patch Redot first, Godot follows our lead.
wesnoth-0001: A* pathfinding std::find on pq vector for decrease-key
O(V*Q) per relaxation, fix: lazy deletion. HIGH, 1279x at N=5000.
wesnoth-0002: server ip_log_ deque linear scan on login/logoff
O(N) per event with N up to 500. MEDIUM, 437x at L=2000.
wesnoth-0003: combine_special_notes O(N^2) vector dedup
utils::contains on vector per note insertion. MEDIUM, 499x at N=1000.
MOAD-0002 (Intertangle): singletons deeply embedded, not actionable.
MOAD-0003 (Leaked Context): thread_local for debug/call-stack only.
MOAD-0004 (Logged Secret): passwords never logged verbatim.
MOAD-0005 (Thundering Herd): single-threaded game + coroutine server.
6/6 unit tests PASS.
AppConfig.__getattr__ logs raw decoded values when config keys change
via Redis, including OPENAI_API_KEYS, GOOGLE_CLIENT_SECRET, and 20+
other API key/token/password PersistentConfig entries. Fix: redact
values for keys matching SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL denylist.
13/13 PASS
