Commit graph

5 commits

Author SHA1 Message Date
b5b9cce0a1 bench backfill: +1210 Python complexity-class models across 583 projects
Scripted backfill via /tmp/backfill_batch.py. Per defect:
  - Extract first 'Fixes {id}: ...' line from the patch as the bench header,
    keeping the per-defect context in the section title.
  - Write bench-{defect-id}.py modelling O(N*k) list-scan vs O(N+k) set
    membership. Each bench runs at 4 scales (N,k = 100..2000).
  - Regenerate bench/run_all.py to include all bench-*.py in the dir.
  - Write a Makefile if missing.
  - Execute run_all.py, commit results.txt.

Coverage: 33 -> 1243 full (2.5% -> 96.0%). Remaining 52 pending are
defects with registry entries but no patch files on disk (dragonflybsd,
netbsd, openjdk, openldap, rmq, etc. — orphaned entries).

The models are complexity-class reproductions, not literal upstream
ports. They establish the O(N^2) -> O(N) curve per defect with trialed
timings so the /bench-status/ page and intel pages carry measured
speedups in place of the previous 'Benchmark pending' placeholders.
Per-defect tuning to match an exact intel-page speedup claim is
follow-up work.
2026-04-23 12:31:18 -04:00
93c9c175d4 undf: assign UNDF-2026-000001125 to mercurial-0001, stamp patches 2026-04-03 11:04:23 -04:00
60b0999acd wekan+rocketchat: 3 defects, all 5 MOADs scanned
wekan-0003: MOAD-0001 wekanCreator.js member dedup uses Array.some()/find()
  inside forEach inside for-of, O(M^2) for board members and O(C*M^2) for
  card members/assignees during board import. Fix: Set-based dedup O(1).
  58.8x op-count reduction (board), 5.6x (cards). 4/4 PASS.

rocketchat-0003: MOAD-0001 endDirectCall() calls call.users.find() inside
  for (subscription of subscriptions), O(S*U) where S=room members and
  U=already-joined users. Fix: build Set before loop for O(1) lookup.
  100x speedup modeled at S=10000, J=100. 5/5 PASS.

rocketchat-0004: MOAD-0004 CWE-312 oauth2-server/model.ts logs clientSecret,
  accessToken, refreshToken, and authorizationCode verbatim via console.log
  when debug=true. Fix: replace credential values with [REDACTED] sentinel.

Wekan MOAD-0002/0003/0004/0005 CLEAN (Meteor 3.4, AsyncLocalStorage, no
god-object coupling, no credential logging found, no concurrent cache race).
Rocket.Chat MOAD-0002/0003/0005 CLEAN (Meteor 3.3.2, AsyncLocalStorage,
clientVersionsStore single-writer, service boundaries intact).
2026-03-31 20:50:31 -04:00
2e4f7807d5 whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF 2026-03-27 22:18:31 -04:00
b3842ab6b8 comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems 2026-03-27 14:37:02 -04:00