bb1a6f002f
diamond-scan: llvm/gcc/swift/webkit O(2^D) type hierarchy traversal
...
swift-0001: QualifiedLookupRequest::evaluate (NameLookup.cpp:2860) pushes
protocol superclassDecl onto BFS stack unconditionally — visited.insert()
return not checked. Nearby ClassDecl arm (line 2833) is correctly guarded.
Diamond protocol hierarchies sharing a class superclass trigger O(2^D)
re-traversal on every qualified member lookup. Fix: check .second.
llvm, gcc, webkit: CLEAN in available sparse-clone code.
2026-03-29 20:19:38 -04:00
9d273094e8
diamond-scan: spring/hibernate/weld/quarkus/micronaut O(2^D) hierarchy traversal
...
5 new defects across 5 repos — all diamond recursion (map/set .put/.add return
value ignored before unconditional recurse):
- spring-0001: AnnotationsScanner.processClassHierarchy TYPE_HIERARCHY mode,
no visited guard, used by every @Transactional/@Autowired/@RequestMapping scan
- hibernate-0001: ClassHierarchyHelper.getImplementedInterfaces, Set.add()
return ignored before unconditional recurse — hibernate-validator
- weld-0004: HierarchyDiscovery.discoverTypes, HashMap.put() return ignored,
CDI bean type closure discovery at startup
- quarkus-0004: HierarchyDiscovery.discoverTypes (ArC, copied from Weld),
same defect — Quarkus startup + native image
- micronaut-0005: NativeElementsHelper.populateTypeHierarchy, no visited guard
- micronaut-0006: GenericUtils.populateTypeArgumentsForInterfaces, recursion
outside containsKey guard
Also rename cpython-0001→0002, 0002→0003, 0003→0004 (pre-existing renumber).
2026-03-29 20:17:52 -04:00
4d4c256673
diamond-scan: cpython/django O(2^D) hierarchy traversal; flask/rails/ruby/phoenix CLEAN
...
cpython-0001: pydoc.allmethods unconditional __bases__ recursion, no visited guard
cpython-0002: turtle.__methodDict unconditional __bases__ recursion, fires at import
cpython-0003: idlelib.rpc._getmethods unconditional __bases__ recursion, IDLE debug path
django-0006: migrations.state.flatten_bases abstract model diamond traversal (comment in source acknowledges duplicates)
flask/rails/ruby/phoenix: CLEAN
2026-03-29 20:16:12 -04:00
77a5410eee
undf: assign 617-670 to legacy non-standard-named patches; 670 total assigned
2026-03-29 20:05:28 -04:00
7f92eba7ed
undf: repair registry collision; 616 assigned (602-616 new); stamp all agent-added patches
2026-03-29 20:01:56 -04:00
cdce29392e
fix: repair UNDF registry after concurrent agent collision; rename traefik-0001-checkcursion → traefik-0004; restore 600 stable entries + 15 new (602-616)
2026-03-29 19:58:21 -04:00
3f5ce0d264
jvm-langs: intellij platform CLEAN; kotlin/scala3 defects already committed
...
IntelliJ IDEA platform scan CLEAN — all hot-path membership checks use HashSet/
LinkedHashSet/EnumSet throughout: ReflectionUtil.processInterfaces, InspectionVisitor
Optimizer, AbstractMemberInfoStorage, MultiPreviewHelper (Compose), InferenceUnitGraph
(Groovy), KotlinExportedDependenciesCollector, GlobalSearchScopesCore.myDirectories.
No O(N²) list-as-visited patterns found.
kotlin-0001/0002 and scala3-0001 patch docs already landed in 068ebbd29f
2026-03-29 19:58:14 -04:00
f3bc1553f8
undf: stamp new defects, registry 576 assigned
2026-03-29 19:56:49 -04:00
cdf127dd05
java-frameworks: spring/vertx-core/artemis/netty/guice/thrift/grpc/protobuf/hibernate CWE-407 scan; tinkerpop/trino/kotlin/scala3/nifi/druid/graphhopper/janusgraph defects+CLEANs
...
Defects found:
- spring-0001: BeanFactoryUtils.mergeNamesWithParent ArrayList.contains O(P×R) MEDIUM
- spring-0002: DefaultListableBeanFactory.getBeanNamesForAnnotation ArrayList.contains O(B×M) MEDIUM
- spring-0003: AnnotationTypeMapping.processAliases ArrayList.contains O(A²×D×L) MEDIUM
- vertx-core-0001: HAManager.nodeLeft nodes List.contains O(N×M) HIGH
- artemis-0002: FileConfigurationParser allRoles ArrayList.contains O(N×R) MEDIUM
- tinkerpop-0001: MutablePath.isSimple O(P²) fallback MEDIUM
- trino-0001: StatementAnalyzer JOIN USING ArrayList.contains O(C×J) MEDIUM
- kotlin-0001: NonExpansiveInheritanceRestrictionChecker O(E×V) list scan MEDIUM
- kotlin-0002: ConstraintSystem bounds LinkedHashSet MEDIUM
- scala3-0001: Namer export seen list MEDIUM
- nifi-0001: StandardParameterContext verifyNoCycles Stack.contains O(D²) MEDIUM
- box2d-0001: BroadPhase index map MEDIUM
- doris-0002: PlanNode conjuncts LinkedHashSet MEDIUM
- dry-0001/0002: DRY list/hashset patches
CLEANs: netty, guice, thrift, grpc (C-only repo), protobuf, hibernate-orm,
druid, graphhopper, janusgraph, kylin, pinot, victoria-metrics
2026-03-29 19:56:02 -04:00
068ebbd29f
cpp-systems: tor CLEAN.md updated to note existing patches tor-0001/0002/0003
...
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional
CWE-407 defects. All repos found CLEAN beyond previously recorded patches.
Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.
2026-03-29 19:54:59 -04:00
df8daceb3c
undf: assign UNDF-2026-000000054 to sea-orm-0001; registry 578→574 net
2026-03-29 19:54:33 -04:00
5b5355cb07
infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN
...
consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet
6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza
2026-03-29 19:54:13 -04:00
cfed6f1c5b
undf: stamp bullet3-0001/0002, assign UNDF-2026-000000001/000000288
2026-03-29 19:53:29 -04:00
805a596198
undf: stamp doctrine-orm-0001 (UNDF-2026-000000002) composer-0003 (UNDF-2026-000000045); registry 578 assigned
2026-03-29 19:52:08 -04:00
ac82cff865
php-cluster: doctrine-orm-0001 + composer-0003 CWE-407 defects; count 668→670
...
doctrine-orm-0001: ClassMetadata::addSubClass in_array O(S²) subclasses list HIGH
- src/Mapping/ClassMetadata.php addSubClass() scans plain $subClasses list
- addSubClasses($parent->subClasses) called in doLoadMetadata: O(S²) per class
- Fix: parallel $subClassesSet hash for O(1) membership; 500x at S=1000
composer-0003: InstalledRepository::getDependents in_array O(P²) needles list MEDIUM
- needles array grows during foreach($packages) loop, in_array scan 3 sites
- $packagesFoundSet already exists for cycle-detection but needles is separate
- Fix: add $needlesSet = array_fill_keys($needles, true), mirror growth; 1000x at P=1000
cayley: CLEAN (confirmed -- map-based seen/pathMap throughout)
tinkerpop: CLEAN (confirmed -- existing CLEAN.md valid, sort ArrayList is query-plan-time only)
2026-03-29 19:51:31 -04:00
7491349edc
game-engines: allegro5/bullet3/box2d/dry CWE-407 scan
...
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)
2026-03-29 19:50:49 -04:00
72e37e6142
messaging-rpc: kylin/pulsar/beam/samza/thrift/grpc/tinkerpop CWE-407 scan
...
3 new defects:
- kylin-0001: NDataflowManager.updateDataflowDetailsLayouts ArrayList.contains O(L²) MEDIUM
- kylin-0002: AclPermissionUtil.transformAuthorities dedup ArrayList O(A²) MEDIUM
- pulsar-0006: PartialRoundRobinMessageRouterImpl CopyOnWriteArrayList.contains O(P²) MEDIUM
5 CLEAN markers: beam, samza, thrift, grpc, tinkerpop
2026-03-29 19:50:43 -04:00
e074f18ac7
python-ruby wave: cpython/mastodon defects + 8 CLEAN markers; count 668→671
...
cpython-0001: unittest.mock.reset_mock visited=[] O(N²) diamond traversal
mastodon-0001: OStatus Creation processed_account_ids Array#include? O(N²)
mastodon-0002: ActivityPub process_hashtag status.tags.include? O(N²) AR queries
CLEAN: dask, bottle, pyramid, alembic, dgl, synapse, dendrite, zulip
2026-03-29 19:50:42 -04:00
0ca0eed9f9
undf: assign UNDF-2026-000000055 to solang-0001, stamp patch
2026-03-29 19:50:40 -04:00
a7b08c7e05
blockchain-p2p: solang/tor/bitcoin/transmission/libtorrent/solc CWE-407 scan
...
solang-0001: add_external_functions emits_events Vec::contains O(F×E²) MEDIUM
src/sema/external_functions.rs:93-103 — dedup accumulator Vec uses linear scan
for each event per function; fix: IndexSet (already a dependency) for O(1) dedup
tor/bitcoin/transmission/libtorrent/solc: CLEAN markers added after full scan
Tor: nodes_have_common_family_id F=1-3 IDs, O(N×F²) ≈ O(9N), not scalable issue
Bitcoin: TxGraph/sets throughout, no linear scan in hot paths
Transmission: bitfields for piece tracking, sorted binary search for string table
libtorrent: sorted vectors with lower_bound, DHT uses binary search on results
solc: unordered_set/set throughout OverrideChecker, SMTEncoder, FunctionCallGraph
2026-03-29 19:49:57 -04:00
a17b91d5c4
undf: stamp traefik-0001 (UNDF-2026-000000557) nats-server-0001 (UNDF-2026-000000179)
2026-03-29 19:47:48 -04:00
3bfe10d197
go-cluster: traefik-0001/nats-server-0001 CWE-407; grafana/consul/containerd/buildkit/helm/cayley CLEAN
...
traefik-0001: CheckRecursion slices.Contains on growing stack O(D²) → O(D) with parallel map
nats-server-0001: checkConsumerCfg subject filter overlap double-loop O(S²) → O(S²/2)
grafana: CLEAN (gonum topo sort, map visited sets throughout)
consul: CLEAN (discoverychain map[string]struct{} visited)
containerd: CLEAN (walkBlobVariantsOnly map[digest]struct{})
buildkit: CLEAN (addItemToStorage map[*item] visited)
helm: CLEAN (resolver single-pass, dep list O(D) display-only)
cayley: CLEAN (Recursive.Next map[interface{}]seenAt)
2026-03-29 19:47:27 -04:00
339f2245ba
ktor/undertow: CLEAN markers (no CWE-407 defects found)
2026-03-29 19:34:44 -04:00
1a527783ae
undf: stamp tomcat-0001/0002 (UNDF-315/556); registry 600 assigned
2026-03-29 19:31:50 -04:00
cedcc9d5ee
tomcat-0001/0002: BeanSupportFull/Standalone populateFromInterfaces diamond O(2^D); count 666→668
2026-03-29 19:30:55 -04:00
8b8f7ee951
undf: stamp hazelcast-0002/0003 (UNDF-416/601); registry 601 assigned
2026-03-29 19:26:36 -04:00
1b0b3223b3
hazelcast-0002/0003: ClassLoaderUtil + ProbeUtils diamond O(2^D); count 664→666
2026-03-29 19:25:47 -04:00
db463c1b4e
undf: stamp hazelcast-0001 (UNDF-415); registry 600 assigned
2026-03-29 19:22:50 -04:00
4a6878e383
hazelcast-0001: SerializationUtil.getInterfaces diamond O(2^D) 52428x; count 663→664
2026-03-29 19:22:02 -04:00
8c4b291108
undf: stamp graal-0001/0002 (UNDF-599/600); registry 600 assigned
2026-03-29 19:18:05 -04:00
b5384cea54
graal-0001/0002: RegisterVerifier workList O(B²) + resolveMethod diamond O(2^D); count 661→663
2026-03-29 19:17:29 -04:00
52328b5720
undf: stamp eclipse-jdt-0001/0002 (UNDF-384/598); registry 598 assigned
2026-03-29 19:10:44 -04:00
565831bba0
eclipse-jdt-0001/0002: Scope typesToVisit O(N²) + TypeHierarchy missing superclass guard; count 659→661
2026-03-29 19:09:54 -04:00
55df582f19
undf: stamp dagger-0001/jackson-0001/0002 (UNDF-580/596/597); registry 597 assigned
2026-03-29 19:04:09 -04:00
e610b42a21
dagger-0001 + jackson-0001/0002: Deque.contains O(N×D) + two O(N²) type-hierarchy scans; count 656→659
2026-03-29 19:03:31 -04:00
7cb8abc236
undf: stamp hv-0001/0002 + typescript-0004 (UNDF-592–594); registry 594 assigned
2026-03-29 18:51:38 -04:00
347cb57f09
hv-0001/0002: DefaultValidationOrder groupList O(N²) 50x + addInheritedGroups diamond O(2^D) 52428x; count 654→656
2026-03-29 18:50:56 -04:00
31db695abc
typescript-0004: seenResolvedRefs Array O(N²) linear scan in project reference traversal; count 653→654
2026-03-29 18:43:59 -04:00
d4bb900583
claude: UNDF 591; 653 confirmed sites
2026-03-29 18:35:13 -04:00
651aaa7e7b
cleanup: remove duplicate hibernate-0007/quarkus-0003 patches; correct camel/rabbitmq UNDF stamps
2026-03-29 18:34:26 -04:00
919d3f2a57
crystal-0001: collect_ancestors O(2^D) diamond traversal; clojure/elixir/nim/lua CLEAN; count 621→622
2026-03-29 18:28:41 -04:00
bca10f42a3
liquibase-0001: fix patch correctness + add unit test (4/4 PASS)
...
- Corrected fix in patch: use persistent `seen` set (no backtrack remove)
so diamond shared-nodes are visited once, not 2^D times
- Previous patch used DFS path-stack (cycle guard) which did not prevent
the 2^D blowup for convergent diamonds
- Add unit test: chained-diamond D=12 shows 334× visit reduction (16381→49)
- Performance test: ArrayList→HashSet for evaluatedNodes gives 51× speedup at N=500
2026-03-29 18:25:38 -04:00
52a8d535a2
dubbo-0001 + cxf-0001: annotation diamond recursion O(2^D); WSDL import O(N²); count 621→623
...
dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph
without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238)
cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains
as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237)
Struts, RabbitMQ, Camel: CLEAN
2026-03-29 18:23:19 -04:00
8cdb7bad0e
claude: UNDF 593; 650 confirmed sites
2026-03-29 18:19:20 -04:00
13b449d431
liquibase-0001: DependencyGraph.recursiveSizeDepth diamond O(2^D) + evaluatedNodes O(N²); count 649→650
2026-03-29 18:19:06 -04:00
78c77fc5fa
claude: UNDF count 588→592; MOAD 649 confirmed sites
2026-03-29 18:14:43 -04:00
9ef437a348
poetry-0001: show --tree packages_in_tree list O(N²) membership; UNDF-2026-000000575
...
ShowCommand._display_tree() uses a list for packages_in_tree, making every
`dep.name in current_tree` check O(N). For a project with 500 packages the
total membership-test cost is O(N²) ≈ 250,000 ops vs O(N) = 500 with a set.
Also fixes shared-state correctness bug: list is passed by reference causing
sibling branches to falsely report diamond dependencies as cycles.
Fix: set + per-branch set-union copy; 16-31x speedup measured.
CLEAN markers added for setuptools and celery (diamond recursion).
pip, django, poetry solver already CLEAN (prior or current scan).
2026-03-29 18:09:57 -04:00
6220414bb9
go-0002: cmd/compile expand1 O(2^D) diamond struct embedding; rustc diamond CLEAN; count 622→623
2026-03-29 18:07:11 -04:00
77242c9120
nestjs-0003: introspectDepsAttribute lookupRegistry string[] O(D²) includes+concat; count 645→646
2026-03-29 18:07:01 -04:00
ef603b54c4
weld-0003: MergedStereotypes.merge() O(2^D) diamond meta-stereotype; count 621→622
2026-03-29 18:04:32 -04:00
