223ccb3fee
0ad: 4 defects, 5-MOAD scan across pathfinding/visibility/templates/lobby
...
0ad-0001 CCmpObstructionManager dirty shapes vector+std::find O(N*D) HIGH 4.1x
0ad-0002 CCmpRangeManager m_ModifiedEntities vector+std::find O(E*M) HIGH 25.8x
0ad-0003 CCmpTemplateManager FindUsedTemplates vector+std::find O(T^2) MEDIUM 5.9x
0ad-0004 XmppClient+NetServer lobby auth token logged verbatim CWE-312 MEDIUM
MOAD-0002 (Intertangle): g_ globals are deliberate single-thread game arch, CLEAN
MOAD-0003 (Leaked Context): thread_local properly scoped, CLEAN
MOAD-0005 (Thundering Herd): single-threaded sim, no cache stampede, CLEAN
4/4 unit tests PASS, UNDF 956-959
2026-03-31 11:58:37 -04:00
16536f2b46
CLAUDE.md: update UNDF count to 955
2026-03-31 11:48:50 -04:00
b7340f0b9b
undf: assign 954-955; veloren-0001 TradePricing O(N^2) CWE-407, veloren-0002 auth token logged CWE-312
2026-03-31 11:48:12 -04:00
dafb9a87ec
CLAUDE.md: update UNDF count to 953
2026-03-31 11:47:12 -04:00
9335217e94
jellyfin-0001/jellyfin-0002: Jellyfin 5-MOAD scan
...
jellyfin-0001 (CWE-407): BaseNfoSaver AddCustomTags xmlTagsUsed List.Contains
O(E*T) per NFO save, fix HashSet O(E). 24.6x at T=50,E=200. UNDF-2026-000000952.
jellyfin-0002 (CWE-312): Logged secrets in SessionManager (access token),
SchedulesDirect (auth token), QuickConnectManager (secret). 3 sites. UNDF-2026-000000953.
MOAD-0002 (Intertangle): CLEAN. No god object pattern detected.
MOAD-0003 (Leaked Context): CLEAN. AsyncLocal only for deadlock detection.
MOAD-0005 (Thundering Herd): CLEAN. FastConcurrentLru with GetOrAdd.
2026-03-31 11:46:30 -04:00
191f018d78
undf: assign 949-951; tiled map editor 3 CWE-407 defects
...
tiled-0001: mapdocument.cpp sortObjects/sortLayers/moveLayersUp/Down/duplicate
QList.contains() inside iteration over all map layers/objects = O(N*S)
Fix: QSet O(1) lookup. MEDIUM severity. 24x speedup at N=2000,S=1000.
tiled-0002: mapobjectmodel.cpp classChanged
QList.contains(tile) inside nested loop over all map objects = O(O*T)
Fix: QSet O(1) lookup. MEDIUM severity. 14x speedup at O=2000,T=500.
tiled-0003: editpolygontool.cpp updateHandles
QList.contains() inside QHash iteration = O(H*S)
Fix: QSet O(1) lookup. MEDIUM severity. 13x speedup at H=1000,S=500.
3/3 PASS. MOAD-0002/0003/0004/0005 CLEAN.
2026-03-31 11:44:37 -04:00
f85ccf9b99
open-webui-0001: CWE-312 logged secret in PersistentConfig Redis sync
...
AppConfig.__getattr__ logs raw decoded values when config keys change
via Redis, including OPENAI_API_KEYS, GOOGLE_CLIENT_SECRET, and 20+
other API key/token/password PersistentConfig entries. Fix: redact
values for keys matching SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL denylist.
13/13 PASS
2026-03-31 11:43:57 -04:00
5a8e0836c3
minetest: remove compiled test binaries
2026-03-31 10:10:41 -04:00
9b1e6fc69a
CLAUDE.md: update UNDF count to 947
2026-03-31 10:10:12 -04:00
a86a765544
minetest (Luanti): 5 CWE-407 defects, all 5 MOADs scanned
...
minetest-0001: mg_ore.cpp c_wherein vector CONTAINS in voxel inner loop O(V*W) HIGH 3.3x
minetest-0002: mg_decoration.cpp c_place_on/c_spawnby vector CONTAINS O(S*P) MEDIUM 1.8x
minetest-0003: l_env.cpp find_node_near/find_nodes_in_area filter CONTAINS O(V*F) MEDIUM 1.6x
minetest-0004: nodedef.cpp nodeboxConnects sorted vector linear scan O(N) MEDIUM 2.1x
minetest-0005: blockmodifier.cpp ABM neighbor check sorted vector O(N) LOW-MEDIUM 1.5x
MOAD-0002: g_settings global singleton (architectural, not patchable)
MOAD-0003: thread_local log streams (properly scoped, not leaked context)
MOAD-0004: CLEAN (no credential logging found)
MOAD-0005: CLEAN (no unsynchronized cache patterns found)
2026-03-31 10:10:03 -04:00
a7907f0e12
supertuxkart-0001: item_manager randomItemsForArena O(N^2) invalid_location scan
...
CWE-407 defect in src/items/item_manager.cpp:635. std::find on
std::vector<int> invalid_location inside retry loop inside placement
loop. Fix: std::unordered_set<int> for O(1) membership. 13.8x at N=500.
MOAD-0002 through MOAD-0005 scanned CLEAN:
- MOAD-0002 (Intertangle): standard game engine singleton pattern
- MOAD-0003 (Leaked Context): thread_local g_process_type is process-scoped
- MOAD-0004 (Logged Secret): HTTP request logging already has credential denylist
- MOAD-0005 (Thundering Herd): no shared cache patterns in network code
2026-03-31 10:09:46 -04:00
77d70fdc46
mindustry CLEAN: all 5 MOADs scanned, no defects found
2026-03-31 10:09:04 -04:00
8ea8ad434f
undf: assign 935-937; cataclysm-dda 3 CWE-407 defects
...
cataclysm-0001: overmap_ui search dedup vector O(P*M), 79x
cataclysm-0002: dependency_tree dedup vector O(N^2), 2x
cataclysm-0003: surroundings_menu item/terfurn dedup O(N^2), 9x
2026-03-31 10:08:23 -04:00
3c1ab5459c
undf: assign 941-943; stamp monogame patches
2026-03-31 10:07:59 -04:00
ec50768d5c
monogame-0001/0002/0003: MonoGame CWE-407 scan, 3 defects
...
monogame-0001: IntermediateWriter.WriteSharedResources writtenSharedResources
List<string>.Contains in while loop O(R^2), fix: HashSet<string> MEDIUM
monogame-0002: IntermediateSerializer._scannedObjects List<object>.Contains
per object during scan O(N^2), fix: HashSet<object> MEDIUM
monogame-0003: OpenAssetImporter._bones List<Node>.Contains in recursive
tree import O(N*B), fix: HashSet<Node> MEDIUM
MOAD-0002 through 0005: CLEAN (single-threaded game framework, no secrets,
no leaked context, no thundering herd)
2026-03-31 10:07:48 -04:00
830b54936d
sparrow-0001/sparrow-0002: Sparrow Wallet CWE-407 scan, 2 defects
...
sparrow-0001: WalletUtxosEntry.updateUtxos() ArrayList.removeAll O(N^2)
UTXO diff uses List.removeAll which is O(current * previous).
Fix: Set-based diff via Sets.difference (same pattern already used
in WalletTransactionsEntry). MEDIUM, 250x at N=1000 UTXOs.
sparrow-0002: UtxoEntry.recountMixesDone stream().anyMatch O(M*I*T)
Whirlpool mix chain walk streams all wallet TXOs per input per mix.
Fix: HashMap<Sha256Hash, Set<Long>> index for O(1) lookup.
MEDIUM-HIGH, 50x at M=200 mixes, T=1000 TXOs.
MOAD-0002 (Intertangle): EventManager is a thin Guava EventBus singleton,
not a god object. Wallet/network/UI coupling is event-driven, acceptable.
MOAD-0003 (Leaked Context): CLEAN, no ThreadLocal usage found.
MOAD-0004 (Logged Secret): CLEAN, no private keys/mnemonics/passphrases
logged. SecureChannelSession has commented-out secret logging.
MOAD-0005 (Thundering Herd): CLEAN, no unsynchronized cache patterns.
4/4 unit tests PASS. UNDF-2026-000000931 through UNDF-2026-000000932.
2026-03-31 09:41:11 -04:00
34c888772f
CLAUDE.md: update UNDF count to 934
2026-03-31 09:40:19 -04:00
c2a1fc15cc
undf: assign 928-930; btcpayserver CWE-407 scan (3 defects)
...
btcpayserver-0001: WalletTransactionInfo.Merge Attachments.Any O(A*B) MEDIUM
btcpayserver-0002: AppService gap-fill series.All O(D*S) LOW-MEDIUM
btcpayserver-0003: StringExtensions.IsValidFileName GetInvalidFileNameChars O(F*I) MEDIUM
2026-03-31 09:39:59 -04:00
f92dc0f8aa
rust-bitcoin CLEAN: 5-MOAD scan, no defects found
...
BTreeMap/BTreeSet throughout, sort+windows for dedup, stateless design.
Rust type system prevents most MOAD patterns structurally.
2026-03-31 09:39:15 -04:00
44f4bf5253
bitcoinjs-lib CLEAN: 5-MOAD scan, all consensus-bounded
...
CWE-407 array scans exist but bounded by Bitcoin consensus (p2ms max
n=20, taptree max depth 128). No adversarial scaling possible.
No intertangle, leaked context, logged secrets, or thundering herd.
2026-03-31 09:38:24 -04:00
ede0450c2b
CLAUDE.md: update UNDF count to 927
2026-03-31 09:16:58 -04:00
995cd9af22
undf: assign 925-927; stamp cake_wallet patches
2026-03-31 09:16:17 -04:00
0f9405d169
cake_wallet 5-MOAD scan: 3 CWE-407 defects + 1 CWE-312 defect
...
MOAD-0001 (CWE-407):
- cake_wallet-0001: exchange_view_model token injection List.any() O(T*L), 275x
- cake_wallet-0002: currency_pairs_utils/pairs_utils List.contains() O(ALL*N), 139x
- cake_wallet-0003: monero/wownero _usedAddresses List.contains() O(S*U), 275x
MOAD-0004 (CWE-312):
- cake_wallet-0004: zcash_taddress_rotation prints wallet seeds to verbose log
MOAD-0002: NOTED (SettingsStore 2228 lines, DI 1765 lines, global currentWallet)
MOAD-0003: CLEAN (no Zone.current / zone-scoped wallet identity)
MOAD-0005: CLEAN (Dart single-threaded, no concurrent cache races)
8/8 unit tests PASS
2026-03-31 09:16:05 -04:00
b62fd27e28
undf: assign 920-922; stamp wasabi patches
2026-03-31 09:13:59 -04:00
737891b5a1
undf: assign 917; stamp bcoin patch
2026-03-31 09:13:04 -04:00
2002c492a0
bcoin 5-MOAD scan: 1 defect (bcoin-0001 gettxoutproof O(H*T) linear scan, 48x)
2026-03-31 09:12:53 -04:00
65389dd651
CLAUDE.md: update UNDF count to 916
2026-03-31 08:07:52 -04:00
36f9dd6a51
undf: assign 915-916; stamp wekan patches
2026-03-31 08:06:03 -04:00
d15b9b06d3
wekan-0001/wekan-0002, kodi CLEAN: 5-MOAD scan across PrusaSlicer/Kodi/Wekan
...
wekan-0001: boards.js setNewLabelOrder indexOf in sort comparator O(L^2 logL) MEDIUM 808x
wekan-0002: cards.js moveToBoard filter+includes O(M*A) MEDIUM 58x
kodi: CLEAN for CWE-407 (proper maps/sets/contains throughout)
prusaslicer-0002: fix test N parameter for reasonable runtime
cleanup: remove .class artifacts from prusaslicer tests
2026-03-31 08:05:29 -04:00
aff709eb3a
CLAUDE.md: update UNDF count to 914
2026-03-31 07:49:39 -04:00
3c3f9639cf
undf: assign 908-914; stamp transformers/ray-project/dask-project patches
2026-03-31 07:48:39 -04:00
13a4de8613
transformers-0001/ray-project-0001/dask-project-0001/dask-project-0002: 4 CWE-407 defects across 3 ML/data targets
...
transformers-0001: tokenization_python convert_ids_to_tokens O(T×S) property-rebuild-per-token MEDIUM 3.1x
ray-project-0001: dag_node _get_toplevel_child_nodes O(A²) list dedup MEDIUM 1.5x
dask-project-0001: parquet filter_partitions disjunction O(P×O) list dedup MEDIUM-HIGH 65x
dask-project-0002: methods describe_aggregate O(C²) column name dedup LOW-MEDIUM 12.7x
2026-03-31 07:48:07 -04:00
4560936024
CLAUDE.md: update UNDF count to 907
2026-03-31 07:39:47 -04:00
0606e6329a
undf: assign 907; stamp weechat-0001 patch
2026-03-31 07:38:34 -04:00
128d349072
weechat-0001: nicklist dedup O(N^2) linear search on join
...
gui_nicklist_add_nick calls gui_nicklist_search_nick which linearly
scans the nick linked list for each add. Joining a 2000-user IRC
channel causes O(N^2) work. Fix: hash table for O(1) dedup. 999x ratio.
2026-03-31 07:37:50 -04:00
53ce6d7ab6
undf: assign 898-906; stamp dosbox-x/rpcs3/ppsspp patches
2026-03-31 07:33:50 -04:00
50c1301928
dosbox-x-0001/0002, rpcs3-0001/0002/0003, ppsspp-0001/0002/0003: 8 CWE-407 defects across 3 emulators
...
DOSBox-X: overlay drive DOSnames_cache + deleted_files_in_base vector dedup (devs commented "set is probably better")
RPCS3: SPU recompiler predecessor/call vector dedup + cellSaveData blist sort comparator
PPSSPP: kernel thread/semaphore waitingThreads dedup + IR JIT byPage block removal
16/16 unit tests PASS, ratios 5-93x
2026-03-31 07:33:28 -04:00
87a11e22f9
undf: assign 895-897; stamp forgejo/snort3/tryton patches
2026-03-30 18:46:58 -04:00
8660303f5a
forgejo-0001/snort3-0001: 2 CWE-407 defects from MOAD multi-scan
...
forgejo-0001: Results.RepoIDs() slices.Contains dedup O(N^2) in code search — 107x at N=5000
snort3-0001: ServiceDiscovery service_candidates std::find dedup O(M*C) in AppID — 59x at M=10000
2026-03-30 18:46:38 -04:00
2798f926fc
CLAUDE.md: update UNDF count to 894
2026-03-30 17:40:39 -04:00
5802db9fc3
undf: assign 893-894; stamp proton patches
2026-03-30 17:39:33 -04:00
2f03245f7b
proton: 2 CWE-407 defects — find_iface_constructor O(C) linear scan + merge_user_dir list explosion
...
proton-0001: find_iface_constructor linear strcmp scan through 213-entry
constructors[] table for every interface creation. Fix: binary search.
4.6x speedup measured.
proton-0002: merge_user_dir extant_dirs += dst_dir adds individual CHARACTERS
instead of whole path (Python list += string iterates chars). Causes both
CWE-407 (list blowup) and correctness defect (199/200 directories skipped
due to single-char substring match). Fix: extant_dirs.append(dst_dir).
MOAD-0002 (Intertangle): CLEAN — env-var isolation between components
MOAD-0003 (Leaked Context): CLEAN — per-game Wine prefix isolation
MOAD-0004 (Logged Secret): CLEAN — no credential logging found
MOAD-0005 (CWE-362): CLEAN — FileLock + CRITICAL_SECTION discipline
Wine's ChangeServiceConfig password logging (wine-0001) inherited but not
in Proton's own codebase.
2026-03-30 17:38:41 -04:00
716a789008
CLAUDE.md: update UNDF count to 892
2026-03-30 17:34:31 -04:00
c12412cda6
undf: assign 887-892; stamp thunderbird patches
2026-03-30 17:33:38 -04:00
6a025795dc
thunderbird: 6 CWE-407 defects from 5-MOAD deep scan via Searchfox
...
thunderbird-0001: nsMsgAccountManager LoadAccounts IndexOf O(N^2) dedup MEDIUM 192x
thunderbird-0002: nsMsgCopyService DoNextCopy ContainsObject O(N^2) MEDIUM-HIGH 44x
thunderbird-0003: nsAutoSyncManager IndexOf in sync loops O(N^2) HIGH 751x
thunderbird-0004: nsImapFlagAndUidState Contains/IndexOf linear on sorted O(N) HIGH 107x
thunderbird-0005: nsMsgFilterList ComputeArbitraryHeaders FindInReadable O(H^2) MEDIUM 64x
thunderbird-0006: nsSpamSettings CheckWhiteList linear email scan O(M*E) MEDIUM 153x
MOAD-0002 (Intertangle): MEDIUM - singleton nsMsgAccountManager shared across protocols
MOAD-0003 (Leaked Context): LOW-MEDIUM - IMAP connection pool single auth boolean
MOAD-0004 (Logged Secret): MEDIUM - debug builds log credentials via MOZ_UPDATE_CHANNEL bypass
MOAD-0005 (CWE-362): LOW-MEDIUM - IMAP folder DB init and connection pool TOCTOU
12/12 unit tests PASS
2026-03-30 17:33:16 -04:00
f2d7a3127e
5-MOAD scan: pcsx2 2 defects, wine 1 defect + 1 MOAD-0004, thunderbird unavailable
...
PCSX2:
- pcsx2-0001: Patch::ReloadEnabledLists 4x std::find on vector O(N^2) MEDIUM 6-12x
- pcsx2-0002: GSCapture codec dedup std::find_if O(N^2) LOW 11x
- MOAD-0002/0003/0004/0005: CLEAN
Wine:
- wine-0001: ntdll/loader.c find_module_dependency O(D) linked-list dedup HIGH 7x
- MOAD-0004: ChangeServiceConfig logs password via debugstr_w MEDIUM
- MOAD-0002/0003/0005: CLEAN
Thunderbird: source unavailable (nicholasb2101/gecko-dev repo inaccessible)
2026-03-30 17:25:38 -04:00
4d2d38fe6e
undf: assign UNDF numbers, stamp patches; 886 total
2026-03-30 17:21:56 -04:00
3aaecab0e1
openscad-0001: AMF export vertex dedup std::find O(V²) → HashMap O(V)
...
Defect: export_amf.cc add_vertex() uses std::find on std::vector for every
vertex during AMF export. For meshes with V vertices, total cost is O(V²).
Fix: parallel unordered_map<vertex_str, size_t> for O(1) lookup.
Unit test: 5-16x ratio at V=500-5000, PASS.
2026-03-30 17:21:45 -04:00
e770a47477
undf: assign UNDF numbers, stamp patches; 882 total
2026-03-30 16:57:20 -04:00
0de158cd7a
monitoring scan: nagioscore 2 defects, zabbix 2 defects, zenoss CLEAN
...
nagioscore-0001: add_notification find_notification linked-list O(C²) HIGH 999x
nagioscore-0002: add_object_to_objectlist linked-list dedup O(N²) MEDIUM 1499x
zabbix-0001: process_problem_tags tag dedup O(T²) HIGH 1499x
zabbix-0002: discoverer_queue_lock job ID dedup O(N²) MEDIUM 1499x
zenoss: CLEAN — uses OrderedDict/set/catalog throughout
4/4 PASS, 4 defects across 2 targets
2026-03-30 16:56:56 -04:00
