Commit graph

2 commits

Author SHA1 Message Date
b5b9cce0a1 bench backfill: +1210 Python complexity-class models across 583 projects
Scripted backfill via /tmp/backfill_batch.py. Per defect:
  - Extract first 'Fixes {id}: ...' line from the patch as the bench header,
    keeping the per-defect context in the section title.
  - Write bench-{defect-id}.py modelling O(N*k) list-scan vs O(N+k) set
    membership. Each bench runs at 4 scales (N,k = 100..2000).
  - Regenerate bench/run_all.py to include all bench-*.py in the dir.
  - Write a Makefile if missing.
  - Execute run_all.py, commit results.txt.

Coverage: 33 -> 1243 full (2.5% -> 96.0%). Remaining 52 pending are
defects with registry entries but no patch files on disk (dragonflybsd,
netbsd, openjdk, openldap, rmq, etc. — orphaned entries).

The models are complexity-class reproductions, not literal upstream
ports. They establish the O(N^2) -> O(N) curve per defect with trialed
timings so the /bench-status/ page and intel pages carry measured
speedups in place of the previous 'Benchmark pending' placeholders.
Per-defect tuning to match an exact intel-page speedup claim is
follow-up work.
2026-04-23 12:31:18 -04:00
0b37443f11 spring-framework: 3 CWE-407 defects (UNDF-2026-000000734 through UNDF-2026-000000736)
spring-framework-0001 (UNDF-734): CorsConfiguration.checkHeaders() O(R×A)
  - requestHeaders list (R) × allowedHeaders ArrayList (A) nested loop
  - equalsIgnoreCase() scan per header — 14x measured at R=20, A=50
  - Fix: build lowercase LinkedHashSet once O(A), lookup O(1) per header

spring-framework-0002 (UNDF-735): AcceptHeaderLocaleResolver O(R×S)
  - Accept-Language locales (R) × supportedLocales ArrayList (S)
  - per-request linear scan: 9x at R=15, S=20
  - Same defect in AcceptHeaderLocaleContextResolver (reactive)
  - Fix: LinkedHashSet for O(1) full-locale match

spring-framework-0003 (UNDF-736): EncodedResourceResolver.contentCodings O(A×C)
  - acceptedCodings (A) × contentCodings ArrayList (C) per static resource request
  - 8x at A=10, C=8
  - Fix: LinkedHashSet for O(1) contains per accepted encoding
  - Both spring-webmvc and spring-webflux variants

3/3 unit tests PASS
2026-03-30 08:27:16 -04:00