Commit graph

6 commits

Author SHA1 Message Date
9325c98470 moad-sweep: 9 initial findings — MOAD-0005 (Hungry Regex) x1, MOAD-0006 (Thundering Herd) x8
MOAD-0005 candidates (ReDoS):
- bleach-MOADX-0001: sanitize_css O(2^N) — 71-char input causes 12s hang HIGH

MOAD-0006 candidates (Thundering Herd / cache stampede):
- hibernate-orm-MOADX-0001: QueryInterpretationCacheStandardImpl HQL plan cache HIGH
- elasticsearch-MOADX-0001: EnrichCache "intentionally non-locking" enrich search HIGH
- hadoop-MOADX-0001: FederationJCache/FederationCaffeineCache YARN default config HIGH
- celery-MOADX-0001: BaseBackend.get_task_meta chord fan-in Redis stampede HIGH
- traefik-MOADX-0001: CNAMEFlatten data race + N*30s DNS stampede HIGH
- kafka-MOADX-0001: CachedConnectors.lookup classloader scan MEDIUM
- spring-MOADX-0001: AbstractFallbackCacheOperationSource @Cacheable cold start MEDIUM
- django-MOADX-0001: cached.Loader.get_template template compile MEDIUM

CLEAN: Consul (singleflight), Kubernetes (RWMutex), Prometheus (per-scraper),
Pulsar (AsyncLoadingCache), Cassandra (LoadingCache), Flink (CAS loop),
ZooKeeper (synchronized), Airflow (hand-rolled singleflight)
2026-03-29 21:09:07 -04:00
9ef437a348 poetry-0001: show --tree packages_in_tree list O(N²) membership; UNDF-2026-000000575
ShowCommand._display_tree() uses a list for packages_in_tree, making every
`dep.name in current_tree` check O(N). For a project with 500 packages the
total membership-test cost is O(N²) ≈ 250,000 ops vs O(N) = 500 with a set.
Also fixes shared-state correctness bug: list is passed by reference causing
sibling branches to falsely report diamond dependencies as cycles.
Fix: set + per-branch set-union copy; 16-31x speedup measured.

CLEAN markers added for setuptools and celery (diamond recursion).
pip, django, poetry solver already CLEAN (prior or current scan).
2026-03-29 18:09:57 -04:00
212d313185 bazel-0003 + kicad-0002: build toolchain feature check + PCB zone filler O(Z²×L²); count 601→603 2026-03-27 22:38:32 -04:00
2e4f7807d5 whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF 2026-03-27 22:18:31 -04:00
424a2a7787 wave12: 501/237 — ClickHouse/Druid/Pinot + Ansible/OpenTofu/Pulumi + Celery/Camel + VictoriaMetrics/Ceph 2026-03-27 17:34:59 -04:00
3c0b3edc79 wave8c: 452/202 — envoy/cilium, graph-dbs, elixir/nim, k8s/maven + PDF 2026-03-27 16:38:25 -04:00