# UNDF: UNDF-2026-000001136
# Apache OpenOffice — 5-MOAD Scan Result

Scanned: 2026-04-01
Clone: https://github.com/apache/openoffice (depth=1)
Focus: main/sc/ (Calc), main/sw/ (Writer), main/ucb/ (WebDAV/UCB)

## MOAD-0001 (CWE-407): 1 defect — PATCHED (openoffice-0001)

- openoffice-0001: `XclExpXFBuffer::AddBorderAndFill` in `main/sc/source/filter/excel/xestyle.cxx`
  — `std::find_if` on `maBorders` (vector) and `maFills` (vector), called once per XF record
  during `.xlsx` export. O(N²) where N = unique border/fill styles. EXC_XF_MAXCOUNT = 4050,
  giving up to ~8M comparisons each list.
  Fix: parallel `std::unordered_map<sal_uInt64, sal_uInt32>` index maps for O(1) lookup.
  Ratio: 249.5x at N=500, 499.5x at N=1000.
  Also fixes `SaveXFXml` which does the same linear scan per XF.

## MOAD-0002 (Intertangle): CLEAN

No shared mutable global god object coupling found beyond OpenOffice's well-known
UNO service manager, which is an intentional architecture, not an emergent coupling defect.

## MOAD-0003 (Leaked Context): CLEAN

No `thread_local` or `osl_thread_setLocalData` holding request-scoped document identity.
Windows platform code uses `GetThreadLocale()` only for locale queries, not context leakage.

## MOAD-0004 (CWE-312): 1 defect — PATCHED (openoffice-0002)

- openoffice-0002: `CurlSession::curlDebugOutput` in `main/ucb/source/ucp/webdav/CurlSession.cxx`
  — when LogLevel::FINEST is enabled, the curl verbose debug callback logs all outgoing HTTP
  headers verbatim, including `Authorization: Basic base64(user:password)` and
  `Authorization: Digest response=<token>`.
  Fix: `lcl_IsCredentialHeader()` + `lcl_RedactHeader()` sanitize credential headers before
  the log call. Credential header names are preserved; values are replaced with `<redacted>`.

## MOAD-0005 (Thundering Herd): CLEAN

No concurrent cache get+null+compute+put without synchronization found.
OpenOffice's DataPilot (pivot) cache uses `osl::MutexGuard` for all cache table access.
The external reference cache (`ScExternalRefCache`) is not accessed concurrently in hot paths.