Both were flagged in Wave 17 survey as borderline real defects deferred
for follow-up because the fix needed careful design beyond a single-line
set hoist. Both shipped now with full bench + ticket + intel.
UNDF-1310 symfony-0001 (HIGH) - PropertyAccessor::writeCollection.
Doctrine entity collection diff: in_array($item, $collection, true)
per item in $previousValue, then in_array($item, $previousValue, true)
per item in $collection. O(P*C). Fix: dual lookup
(SplObjectStorage for objects + serialize-keyed array for scalars,
in_array fallback for resources). Bench: 5.2x at P=C=100,
88x at P=C=2000.
UNDF-1311 pyright-0001 (HIGH) - CallHierarchyProvider outgoing/incoming
call dedup. _outgoingCalls.find / _incomingCalls.find with composite
key (uri, range) walks the list per call expression. O(C^2). Fix:
parallel Map<string, entry> keyed by composite serialized form
(uri|start.line|start.char|end.line|end.char). Bench: 2.7x at C=100,
22x at C=2000.
Total session flagships: 11 (was 9) — 7 CWE-407 + 3 MOAD-0003 + 1 MOAD-0004.
Wave 17 borderline backlog now empty.
Acting on the 4 borderline candidates flagged in the session-summary intel.
All 4 surfaced after the unmoad scanner enhancements cleared M3/M4 noise.
UNDF-1306 wildfly-0002 (HIGH) - ElytronSecurityDomainContextImpl.isValid()
sets currentIdentity ThreadLocal with no paired cleanup contract. Subject
populated at line 69 is the canonical handover; the ThreadLocal stash leaks
to next request on the pool thread. Fix: drop the .set(identity) line.
UNDF-1307 wildfly-0003 (LOW) - TransactionRollbackSetupAction.depth.set(null)
should be depth.remove() to fully delete the ThreadLocal entry; current
pattern leaves null binding pinning the WildFly classloader during
undeploy/redeploy. Functional clear, classloader-retention only.
UNDF-1308 log4j2-0001 (HIGH) - Log4jMDCAdapter.clear() only clears the
log4j ThreadContext map, NOT the SLF4J pushByKey/popByKey stacks
(mapOfStacks ThreadLocal). SLF4J spec mandates clear() means "clear
all MDC". Per-key Deques accumulate across requests. Fix: add clear()
to ThreadLocalMapOfStacks (calls tlMapOfStacks.remove()) and call from
the public clear().
UNDF-1309 nakama-0001 (HIGH MOAD-0004) - social/social.go logs OAuth
access tokens, ID tokens, oauth2.Token objects (incl. refresh tokens),
Steam publisherKey + ticket at debug level via zap.String/zap.Any.
11 call sites. Fix: replace value-logging with shape-logging (token_len,
has_token bool) — preserves debug value, redacts secret bytes.
First MOAD-0004 patch this session. Companion to the 3 MOAD-0003 patches
(wildfly-0001/0002/0003) extending the inverse-pipeline pattern across
projects: scanner enhancement -> noise reduction -> human triage finds
defects that were buried.
Total session flagships: 9 (was 6) — 5 CWE-407 + 3 MOAD-0003 + 1 MOAD-0004.
Single entry point for fox to resume. Documents the three pipelines used
(forward CWE-407, inverse scanner-then-human, wave breadth), the 6 UNDF
flagships shipped (1300-1305), the 22 wave surveys (waves 7-28; 8
full-clean), the 10 unmoad scanner enhancements clearing ~51679 FPs
across 19 codebases, and 4 borderline candidates flagged for fox review
(ElytronSecurityDomainContextImpl.isValid, log4j2 Log4jMDCAdapter,
WildFly TransactionRollbackSetupAction, nakama MOAD-0004).
Stop condition explicit: per CLAUDE.md 'Unsure = ask. Can't ask = stop.'
The diminishing-returns signal (8 consecutive full-clean waves at
session midpoint, exhausted high-leverage scanner backlog by end) means
the honest move is to pause for fox redirect rather than invent
marginal-value work.
First MOAD-0003 (Leaked Context) flagship this session. Surfaced via
scanner enhancement: commit 1f48798 (Java ThreadLocal-scoped .set fix)
dropped wildfly M3 noise from 4840 -> 37, exposing this real defect.
Defect: ElytronSecurityIntegration.java:38 declares
private final ThreadLocal<SecurityContext> securityContext = new ThreadLocal<>();
with setSecurityContext() calling .set(context) and ZERO corresponding
.remove() / .set(null) anywhere in the WildFly codebase (verified by
grep -rn). JCA WorkManager reuses pool threads across Work items from
different security principals; a leftover SecurityContext from prior
Work is visible to any subsequent Work that reads getSecurityContext()
before installing its own — which WildflyWorkWrapper.runWork() does
exactly to decide whether to use Elytron-runWork or super.runWork().
Fix: 2-file surgical patch (no SPI change):
1. setSecurityContext(null) now calls .remove() (clear ThreadLocal,
prevent classloader retention)
2. WildflyWorkWrapper.runWork() wraps body in try/finally that calls
setSecurityContext(null) after the Work item completes
This is the inverse pipeline from CWE-407 flagships: scanner improved
its signal-to-noise so triage could find what raw scanning could not
have ranked.
Documents this autonomous-loop session's pivot from breadth wave scanning
to unmoad scanner enhancements. Each fix targeted a documented FP class
(noted across waves 11/15/18/21/24/26 + others), shipped + validated
end-to-end against re-cloned source.
Architecture: per-file symbol tables on ScanState (hash_vars for M1,
tl_vars for M3) + path/header/argument-shape heuristics. Three repos in
sync, all unmoad commits remain local (no remote per project CLAUDE.md).
Notable byproduct: with M3 noise dropped wildfly 4840 -> 37 (commit
1f48798), one real ThreadLocal leak surfaces as a MOAD-0003 candidate
for fox's review — ElytronSecurityIntegration.securityContext.set(context)
with zero remove() calls anywhere in the WildFly codebase. Out of CWE-407
scope; MOAD-0003 follow-up.
yarn, pnpm, lerna, nx, turborepo, tcl, gawk, gnuplot, coreboot, openocd
all clean. Honor roll cumulative: 184 projects.
Package managers bounded by manifest dep graph. Firmware projects
bounded by fixed adapter/board tables. Scripting languages bounded by
language grammar.
Three coupled defects in RTTIGccClassRecoverer:
1. isPossibleVttStart REBUILDS vtableAndVftableAddrs on every call (O(V) waste)
2. getVttAddresses calls it inside outer while loop (multiplies the rebuild)
3. addPointerToList uses List<Address>.contains for membership (O(V) per check)
Fix: hoist Set<Address> once, pass to isPossibleVttStart, eliminate per-call rebuild.
ghidra-0001 covers RecoveredClassHelper (MSVC + gcc) — the foundation pattern.
ghidra-0002 covers gcc-specific VTT recovery — extends coverage to Linux C++ binaries.
Together: ghidra C++ class recovery drops from seconds-to-minutes to milliseconds.
wildfly, typo3, chef, kitty, qpdf, jq, miller, matplotlib, vitess, nano
all clean. Honor roll cumulative: 174 projects.
Wildfly 4840 M3 are JUnit ExtensionContext. Wildfly 279 M1 are
Set/EnumSet declared-type FPs. TYPO3 934 M1 are 100% vendored frontend
(ckeditor5, codemirror, bootstrap, chartjs). matplotlib itertools.count
distinguished from list.count needed.
Three more scanner enhancement candidates (Java declared-type for the
fifth time, itertools.count vs list.count, M4 interpolated-value vs
string-literal).
10 PHP fw / Python tooling / JS bundler targets scanned. Honor roll
cumulative: 86 projects. Two borderline candidates documented for
type-aware follow-up (symfony PropertyAccessor::writeCollection O(P*C),
pyright callHierarchyProvider O(C^2)) — both real but need type-aware
helpers, not single-line set hoists.
10 sci/static-site/api-gateway/games targets scanned. Honor roll cumulative:
54 projects. scipy distance_impl.h M7 cluster is intentional distance
algorithms (FP). kong M4 cluster is test-fixture credential headers.
synapse haystack.contains is intentional substring pre-check before regex.
No flagship CWE-407 this pass.
Flagship: weaviate authorization filter slices.Contains per item (O(N*K)).
Multi-tenant deployments with hundreds-thousands of permitted resources pay
this on every authorized read. Set hoist: 1735x speedup at N=50k K=5k.
Wave 11 honor roll: bash, coreutils. Cumulative: 49 projects.
10 observability/streaming targets scanned. Honor roll cumulative: 34 projects.
No flagship CWE-407 — VictoriaMetrics streamaggr.getInputOutputLabels real
but constant-factor at realistic config shapes (W <=10, L <=30, ~2-3x impact),
below the 5x wall-clock bar. Logged for re-scan if W >30 case surfaces.
29 mail/DNS/storage/VPN/RTOS/pg-eco targets scanned. No flagship CWE-407 patches
this pass — strong M1 candidates resolved to bounded fixed config tables
(strcmp on rule lookups), already-optimal data structures (RoaringTreemap,
ObjHashSet), or query-shape constants too small to cross the wall-clock bar.
Honor roll: 30 projects cumulative across waves 3-7. questdb `recordViews`
borderline real defect (O(N²) view dedup on ObjList) logged for future pass.
Scanned the three foundational Python documentation tools (Sphinx,
docutils, Pelican) and documented the triage outcome.
Pelican joins the clean-scan honor roll (now 25 projects). Both flagged
findings tested as false positives — utils.py:485 is String.index for
'\n', not list iteration; pelican_import.py:663 ReDoS pattern scales
linearly at N=40 (0.11ms).
Sphinx + docutils have multiple M1 hits in node-tree walks
(Node.findall via parent.index per ancestor). Investigated and
benchmarked: both old and new algorithms are O(D*S) — constant-factor
only, not CWE-407-grade complexity-class change. A real fix would
require maintaining a parent_index cache on Element nodes, a refactor
with cache-invalidation surface area beyond a single-defect patch.
No patches shipped this pass; the work is documented for the next
reviewer.
The Gatsby authors annotated each of the three call sites in
in-memory/indexing.ts with 'expensive at scale' comments. Their
diagnosis is correct: nodeTypeNames.includes(node.internal.type)
inside iterateNodes().forEach is O(N*T) per cache build.
For N=100k+ nodes typical of mature content sites and T=10-30
declared types per query, this fires on every type-filtered query.
gatsby develop in particular rebuilds caches per page render.
Fix: hoist Set<string> once at the top of each function. O(1) per
node lookup. Total cost O(N+T). Bench shows 8.4x at N=100k T=50;
2.7-4.7x at smaller scales.
Three call sites patched: ensureIndexByElemMatch (line 326),
ensureEmptyFilterCache (378), ensureIndexByElemMatchValue (504).
Author 'expensive at scale' comments updated to record the fix.
Investigated the top 2 triage-backlog items from the Wave 4 survey:
- PHP_CodeSniffer Tokenizers/PHP.php ReDoS: scanner flagged
((?<!\.)_[0-9A-F][0-9A-F.]*)+$ as catastrophic-backtracking shape.
Empirical test shows the underscore-anchored inner group prevents
overlap between outer iterations; Python re matches N=50 pathological
input in sub-millisecond time. False positive. Scanner could be taught
to recognize anchor-prefix inner groups as safe.
- aws-cdk region-info.ts limitedRegionMap: partitions.includes inside
per-region loop is a real O(R*P) shape. At realistic scale (R=35
regions, P=2-4 partitions) the wall-clock improvement is constant-
factor only; bench shows 2.9x at R=2000 P=100 but collapses to 1.0x
at production scale. Cleanup-grade, not CWE-407 complexity-class
emergency; no patch shipped.
Both findings documented in the Wave 4 triage section as investigated-
and-resolved. The remaining 5 items stay on the list for future waves.
artemis, doris, gin, gstreamer, igraph, kylin, nifi, open3d, opencv,
ros2, starrocks, trino, victoria-metrics: each had a **Speedup:**
metadata line from an early draft with a small per-defect scenario
number (2.5x, 5x worst case, etc.) that looked contradictory next to
the auto-embedded Measured benchmarks table showing 300-500x.
Rewrote each to 'NNN× measured · X× per-defect scenario' so readers
see the bench headline first and the editorial scenario context after.
Preserves the authors' scenario qualifier (ros2's 'worst case', opencv
and open3d's per-sub-defect split) while surfacing the measurement.
Effect on the audit: understates 63 -> 0, aligned 315 -> 41, since
most 'aligned' hits were actually body-inline mentions my fixed
bench_consistency.py no longer considers as headline claims.
Each of the 3 briefs flagged by bench_consistency.py as claim > measured
now carries an explicit line pairing the op-count claim with the
measured wall-clock speedup and explaining the residual gap.
fbneo-0001: 45,000x claim -> + 2,410x wall-clock at N=45k
(Python dict vs C++ unordered_map constant factor).
mercurial-0001: 5,000x claim -> + 50x wall-clock at k=500
(Python sim ceiling; bench_google_scale.py projects
to Google-scale via ops ratio).
substrate: 38,550x claim -> + 2,009x wall-clock at N=10k
(Python list vs Rust HashSet constant factor).
mercurial-0001 bench also scaled to CASES=[(1000,50), (1000,100),
(1500,200), (1500,350), (1500,500)] to cover k=500 directly.
The audit still counts these as overstates because the claim number
is intentionally the op-count figure; the rendered intel page now
carries both numbers side-by-side so readers can see the reconciliation
without scrolling to the Measured benchmarks table.
testcafe-0001: Selector filterNodes (string-filter branch) and
expandSelectorResults both dedup via Array.indexOf on growing result
arrays. filterNodes: O(N*M) per selector filter. expandSelectorResults:
O(N^2 * K^2) worst case when derivatives unique. Fix: Set<Node> keyed
by object identity. Bench: 398x at N=2000 filter, 1966x at N=K=150
expand.
webdriverio-0002: MSPO aggregator dedups per-test entries via Array.find
on growing bucket array. O(N^2) per test bucket, same pattern repeats
in unknown-suite merger. Fix: companion Map<bucketKey, Set<selector>>
for O(1) dedup. Bench: 493x at N=2000.
UNDF IDs: 1290 (testcafe), 1291 (webdriverio-0002). All 17 tests pass.
All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.
Outreach gap: 276 -> 0.
