# UNDF: UNDF-2026-000000328
From 0000000 Mon Sep 17 00:00:00 2001
Subject: [PATCH] acl: replace selector->patterns/channels lists with dicts for O(1) dedup

CWE-407: ACLSetSelector performs O(P) listSearchKey to deduplicate key
patterns when adding each ~<pattern> rule.  When N rules are applied in
sequence (e.g., ACL SETUSER user ~p1 ~p2 ... ~pN), total cost is
O(1+2+...+N) = O(N²).  Same defect applies to &<channel> rules using
selector->channels.

Trigger: ACL SETUSER myuser ~key:1 ~key:2 ... ~key:N
         ACL SETUSER myuser &ch:1 &ch:2 ... &ch:N
         ACL file load with many per-selector key/channel rules

Severity: MEDIUM
  - Directly controllable by any client with ACL SETUSER permission
  - N=500 key patterns → 125,000 comparisons per SETUSER call
  - N=1000 → 500,000 comparisons

Affected files: src/acl.c:1217 (listSearchKey selector->patterns)
                src/acl.c:1236 (listSearchKey selector->channels)

This is the same CWE-407 defect as Redis (Valkey is a fork; same code).

Fix: see redis-0003 patch — replace listSearchKey with dictFind using
a parallel sds-keyed dict maintained on aclSelector.

Speedup: O(N²) → O(N).  N=500 patterns: 125,000 → 500 comparisons (250x).
         N=1000 patterns: 500,000 → 1,000 comparisons (500x).