d67ec93a5d
test-frameworks wave 3: vitest + testng + jasmine + libcheck (4 patches)
...
vitest-0001: coverage-v8 coverage.result.find inside merged.result.forEach
-> Map<url, result> lookup. Bench: 824x at N=M=10000 coverage entries.
testng-0001: DynamicGraph.toDot freeNodes.contains inside two for-each
loops -> Map<T, String> color lookup via getOrDefault. Bench: 64x at N=2000.
jasmine-0001: SpyRegistry.spyOnAllFunctions propertiesToSkip.indexOf inside
Array.filter + .concat growth across D prototype levels -> Set.has + O(1)
growth. Bench: 61x at D=10, P=300.
check-0001: libcheck suite_tcase linear strcmp scan over tclst List
-> parallel hashtable for O(1) lookup amortized. Bench: 117x at N=1000.
Shipped as design sketch; full integration requires companion hashtable.
Also ships whitepaper/outreach/test-harness-survey.md documenting 14
clean-scan frameworks across Clojure, OCaml, Haskell, Erlang, Go, F#,
Julia, Shell, Lua, JS. Scope covered 61 targets across 30+ languages.
UNDF IDs: 1292 (check), 1293 (jasmine), 1294 (testng), 1295 (vitest).
All 12 tests pass.
2026-04-23 08:54:44 -04:00
b79fddfb51
browser-automation wave 2: testcafe-0001 + webdriverio-0002
...
testcafe-0001: Selector filterNodes (string-filter branch) and
expandSelectorResults both dedup via Array.indexOf on growing result
arrays. filterNodes: O(N*M) per selector filter. expandSelectorResults:
O(N^2 * K^2) worst case when derivatives unique. Fix: Set<Node> keyed
by object identity. Bench: 398x at N=2000 filter, 1966x at N=K=150
expand.
webdriverio-0002: MSPO aggregator dedups per-test entries via Array.find
on growing bucket array. O(N^2) per test bucket, same pattern repeats
in unknown-suite merger. Fix: companion Map<bucketKey, Set<selector>>
for O(1) dedup. Bench: 493x at N=2000.
UNDF IDs: 1290 (testcafe), 1291 (webdriverio-0002). All 17 tests pass.
2026-04-22 18:31:53 -04:00
9a0253e724
browser-automation: 4 CWE-407 patches (selenium x2, playwright, webdriverio)
...
selenium-0001: SessionCapabilitiesMutator list.contains O(NxM) -> LinkedHashSet
O(N+M). Grid Node session mutation hot path. Bench: 192x at N=M=1000.
selenium-0002: ChromiumOptions merge helpers consolidate four list.contains
loops behind addArgumentsUnique/addEncodedExtensionsUnique. Bench: 254x
at N=M=1000.
playwright-0001: roleUtils validRoles / allowsNameFromContent Array.includes
on 20-70 element constant arrays per element. Converted to Set<string>
at module load. Bench: 11x at N=10000 elements.
webdriverio-0001: xpath-conditions extractOrConditions orMatches.find +
values.includes per regex match -> Map<attr, Set<values>>. Bench: 6x at
K=V=60 in the 'mobileSelectorPerformanceOptimizer'.
Each defect ships: ticket, patch with complexity-gate header, Python
benchmark + correctness test, Makefile, outreach brief. All 16 tests
pass. UNDF IDs: 1276 (playwright), 1277 (selenium-0001), 1288
(selenium-0002), 1289 (webdriverio).
2026-04-22 18:14:39 -04:00
67012b350c
scan: lean4 — 7 defect tickets (4x MOAD-0001, 2x MOAD-0005, 1x MOAD-0003)
2026-04-13 08:34:02 -04:00
1f88aa0374
chore: update blast-radius docs, remove merged linux tickets, patch update
2026-04-10 12:47:28 -04:00
716ef7cb2d
undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407)
2026-04-05 19:46:54 -04:00
6050e1b741
hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch
2026-04-05 15:57:48 -04:00
998e2b7b0f
linux: fix ticket doc numbering; add missing docs for 0001/0005/0006/0007/0008
...
- Renamed linux-0001-audit-filter-inodes → linux-0002 (matches patch file reality)
- Renamed linux-0002-dev-alloc-name → linux-0003
- Renamed linux-0003-neigh-parms → linux-0004
- Added linux-0001-headerdep-hash.md (scripts/headerdep.pl detect_cycles CWE-407)
- Added linux-0005-component-find-quadratic.md (drivers/base/component.c)
- Added linux-0006-btf-module-scan-hash.md (kernel/bpf/btf.c bpf_find_btf_id)
- Added linux-0007-pktgen-thread-dev-xarray.md (net/core/pktgen.c)
- Added linux-0008-taskstats-listener-hashset.md (kernel/taskstats.c)
2026-04-04 11:41:36 -04:00
fdbb9a1aa9
redot: 12 CWE-407 defects, patches, outreach brief, UNDF-2026-000001231..1242
...
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.
Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.
Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.
Strategy: patch Redot first, Godot follows our lead.
2026-04-03 21:00:29 -04:00
9934133dcf
whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild
...
Add 88 new defect entries to HIGH and MEDIUM tables:
HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002
MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
ovs-0001, onos-0003, odl-0002, jetty-0001
PDF: 976K
2026-03-27 15:23:43 -04:00
b3842ab6b8
comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems
2026-03-27 14:37:02 -04:00
4d3fcc8e73
game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems
2026-03-27 14:14:49 -04:00
547a9f5738
ORM wave 2: 10 new defects — Active Record +3, Exposed +3, SeaORM +4 (167 sites, 64 ecosystems)
...
rails-0009: FilterAttributeHandler filter_parameters Array O(A×F) → Set (450×)
rails-0010: Encryption::AutoFilteredParameters two Array scans → Set (250×)
rails-0011: TimeZoneConversion skip_list Array O(M×C×S) → Set (20×)
exposed-0001: SchemaUtilityApi mapMissingColumnStatements O(N×M) → map (118×)
exposed-0002: IdentifierManagerApi isAKeyword O(K) linear → HashSet (144×)
exposed-0003: Table.clone consParams.map fresh List → hoisted HashSet (6×)
seaorm-0001: active_model establish_links leftover.any O(N²) → HashSet (501×)
seaorm-0002: rbac engine group_permissions .values().find() → HashMap by ID (502×)
seaorm-0003: schema builder sorted_tables Vec::contains → HashSet (500×)
seaorm-0004: TopologicalSort from_iter seen Vec O(N²) → BTreeSet (28×)
Unit tests: RailsTest 11/11, ExposedTest 3/3, SeaORMTest 4/4 PASS
Whitepaper: 157→167 sites, 62→64 ecosystems; §13.12 ORM Wave 2 added
2026-03-27 13:49:46 -04:00
d4ed2dff91
ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems)
...
Hibernate (5 HIGH): addColumn/addReferencedColumn/addIndex ArrayList→LinkedHashSet (19x)
FK second-pass LinkedHashSet, orderHierarchy LinkedHashSet
MyBatis (1 MEDIUM): sortConstructorMappings indexOf→HashMap (12x)
EF Core (2 HIGH + 1 MEDIUM): FindGenerationProperty HashSet (250x),
AddPrincipals HashSet (250x), FK discovery HashSet (6x)
Diesel (3 MEDIUM): SQLite/MySQL row position()→BTreeMap (51x)
SQLAlchemy (2 HIGH): _values_bindparam Set (500x), evaluated_keys Set (500x)
Peewee (1 MEDIUM): _SortedFieldList.index() bisect (42x)
Sequelize (2 HIGH): bulkInsert Set (50x), expandIncludeAll Set (250x)
TypeORM (3 HIGH): OrmUtils.uniq Map (500x), diffColumns Set (125x),
updatedColumns Set (100x)
Doctrine ORM (1 HIGH + 2 MEDIUM): hydrator discriminator (26x),
addSubClass (250x), SqlWalker partial (130x)
GORM (1 MEDIUM): sortCallbacks getRIndex→map (194x)
SQLite: SqliteTest unit proof 4/4 PASS (101x)
Unit tests: all PASS — Hibernate/MyBatis/EfCore/Diesel/SQLAlchemy/Peewee/
Sequelize/TypeORM/Doctrine/GORM
Whitepaper: 157 sites, 62 ecosystems; PDF 752K
2026-03-27 13:34:26 -04:00
db29a08762
undefect. CWE-407 — 92 sites, 42 ecosystems
...
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00
