package unit; import java.util.*; /** * PylonsTest — pylons-0001..0003 * * Proves CWE-407 in Pyramid (Pylons project) web framework (Python): * pylons-0001: TopologicalSorter.add()/sorted() — `if name in self.names` list scan O(N²) * pylons-0002: TopologicalSorter.sorted() — `if a in names and b in names` list scan O(N*E) * pylons-0003: TopologicalSorter.remove() — `self.order.remove(tuple)` list scan O(E) per edge * * File: src/pyramid/util.py (Pyramid web framework, github.com/Pylons/pyramid) * Lines: 481, 528, 455/460 * * Run: javac -d . PylonsTest.java && java -ea unit.PylonsTest */ public class PylonsTest { // ── pylons-0001: TopologicalSorter.add()/sorted() — self.names list membership ── /** * SLOW: `if name in self.names` — O(n) list scan on every add(). * N calls to add() = O(N²) total. Also: final sorted() result loop scans list O(N²). */ static long topoSorterAddSlow(int nodeCount) { List names = new ArrayList<>(); Map name2val = new HashMap<>(); long ops = 0; for (int i = 0; i < nodeCount; i++) { String name = "node_" + (i % (nodeCount / 2)); // ~50% re-adds (duplicates) // `if name in self.names` — O(n) list scan — CWE-407 boolean found = false; for (String n : names) { ops++; if (n.equals(name)) { found = true; break; } } if (found) { // self.names.remove(name) — O(n) list scan Iterator it = names.iterator(); while (it.hasNext()) { ops++; if (it.next().equals(name)) { it.remove(); break; } } } names.add(name); name2val.put(name, i); } // sorted() result loop: `if name in self.names` — O(n) per item in O(n) loop List sorted_names = new ArrayList<>(names); Collections.shuffle(sorted_names, new Random(42)); for (String sname : sorted_names) { // `if name in self.names` — O(n) scan for (String n : names) { ops++; if (n.equals(sname)) break; } } return ops; } /** FAST: shadow set names_set for O(1) membership on add() and sorted() */ static long topoSorterAddFast(int nodeCount) { List names = new ArrayList<>(); Set names_set = new HashSet<>(); Map name2val = new HashMap<>(); long ops = 0; for (int i = 0; i < nodeCount; i++) { String name = "node_" + (i % (nodeCount / 2)); ops++; // O(1) set lookup if (names_set.contains(name)) { names.remove(name); // O(n) but confirmed; same as original names_set.remove(name); } names.add(name); names_set.add(name); name2val.put(name, i); } // sorted() result loop: O(1) set lookup List sorted_names = new ArrayList<>(names); Collections.shuffle(sorted_names, new Random(42)); for (String sname : sorted_names) { ops++; // O(1) set membership names_set.contains(sname); } return ops; } // ── pylons-0002: TopologicalSorter.sorted() — `if a in names` list scan in edge loop ── /** * SLOW: `if a in names and b in names` — O(N) list scan per edge in O(E) edge loop. * Total O(N*E) — CWE-407. */ static long sortedNamesListSlow(int nodeCount, int edgeCount) { List names = new ArrayList<>(); for (int i = 0; i < nodeCount; i++) names.add("node_" + i); // Simulate self.order edges List order = new ArrayList<>(); Random rng = new Random(42); for (int e = 0; e < edgeCount; e++) { order.add(new int[]{rng.nextInt(nodeCount), rng.nextInt(nodeCount)}); } long ops = 0; for (int[] edge : order) { // O(E) String a = "node_" + edge[0]; String b = "node_" + edge[1]; // `if a in names and b in names` — O(N) list scan x2 boolean aFound = false; for (String n : names) { ops++; if (n.equals(a)) { aFound = true; break; } } if (aFound) { for (String n : names) { ops++; if (n.equals(b)) break; } } } return ops; } /** FAST: names_set = set(names) — O(1) membership per edge */ static long sortedNamesListFast(int nodeCount, int edgeCount) { List names = new ArrayList<>(); for (int i = 0; i < nodeCount; i++) names.add("node_" + i); Set names_set = new HashSet<>(names); // O(N) once List order = new ArrayList<>(); Random rng = new Random(42); for (int e = 0; e < edgeCount; e++) { order.add(new int[]{rng.nextInt(nodeCount), rng.nextInt(nodeCount)}); } long ops = 0; for (int[] edge : order) { // O(E) String a = "node_" + edge[0]; String b = "node_" + edge[1]; ops += 2; // O(1) set lookups x2 names_set.contains(a); names_set.contains(b); } return ops; } // ── pylons-0003: TopologicalSorter.remove() — self.order.remove(tuple) ── /** * SLOW: `self.order.remove((u, name))` — O(E) list scan per edge-removal. * D node removals, each with K constraints = O(D * K * E). */ static long orderListRemoveSlow(int edgeCount, int removals, int constraintsPerRemoval) { List order = new ArrayList<>(); Random rng = new Random(42); // Build order list with edgeCount edges for (int e = 0; e < edgeCount; e++) { order.add(new int[]{rng.nextInt(100), rng.nextInt(100)}); } long ops = 0; rng = new Random(99); for (int r = 0; r < removals; r++) { int name = rng.nextInt(100); for (int k = 0; k < constraintsPerRemoval; k++) { int u = rng.nextInt(100); // self.order.remove((u, name)) — O(E) list scan Iterator it = order.iterator(); while (it.hasNext()) { ops++; int[] e = it.next(); if (e[0] == u && e[1] == name) { it.remove(); break; } } } } return ops; } /** FAST: self.order as set — O(1) discard per edge removal */ static long orderListRemoveFast(int edgeCount, int removals, int constraintsPerRemoval) { Set order = new HashSet<>(); Random rng = new Random(42); for (int e = 0; e < edgeCount; e++) { int a = rng.nextInt(100), b = rng.nextInt(100); order.add((long)a << 32 | b); // encode pair as long } long ops = 0; rng = new Random(99); for (int r = 0; r < removals; r++) { int name = rng.nextInt(100); for (int k = 0; k < constraintsPerRemoval; k++) { int u = rng.nextInt(100); ops++; // O(1) set discard order.remove((long)u << 32 | name); } } return ops; } static void bench(String label, Runnable slow, Runnable fast, long sOps, long fOps) { slow.run(); fast.run(); long t0 = System.nanoTime(); slow.run(); long sMs = (System.nanoTime()-t0)/1_000_000; long t1 = System.nanoTime(); fast.run(); long fMs = (System.nanoTime()-t1)/1_000_000; double r = fOps > 0 ? (double)sOps/fOps : 0; System.out.printf(" %-52s slow:%4dms (%,d ops) fast:%4dms (%,d ops) speedup:%.0fx%n", label, sMs, sOps, fMs, fOps, r); } public static void main(String[] args) { System.out.println("=== UNIT pylons-0001..0003: Pylons/Pyramid CWE-407 (util.py TopologicalSorter) ==="); System.out.println(); final int NODES = 2000; // large config: 2000 tweens/derivers/predicates final int NODES_E = 500, EDGES = 3000; // edge-loop scenario final int EDGE_COUNT = 1000, REMOVALS = 500, CONSTRAINTS = 5; long s0 = topoSorterAddSlow(NODES), f0 = topoSorterAddFast(NODES); long s1 = sortedNamesListSlow(NODES_E, EDGES), f1 = sortedNamesListFast(NODES_E, EDGES); long s2 = orderListRemoveSlow(EDGE_COUNT, REMOVALS, CONSTRAINTS), f2 = orderListRemoveFast(EDGE_COUNT, REMOVALS, CONSTRAINTS); bench("pylons-0001 names list membership in add()/sorted()", () -> topoSorterAddSlow(NODES), () -> topoSorterAddFast(NODES), s0, f0); bench("pylons-0002 sorted() names list in edge loop", () -> sortedNamesListSlow(NODES_E, EDGES), () -> sortedNamesListFast(NODES_E, EDGES), s1, f1); bench("pylons-0003 order.remove(tuple) in remove()", () -> orderListRemoveSlow(EDGE_COUNT, REMOVALS, CONSTRAINTS), () -> orderListRemoveFast(EDGE_COUNT, REMOVALS, CONSTRAINTS), s2, f2); System.out.println(); int pass = 0; assert s0 > f0 * 5 : "pylons-0001 expected >5x speedup"; pass++; assert s1 > f1 * 10 : "pylons-0002 expected >10x speedup"; pass++; assert s2 > f2 * 5 : "pylons-0003 expected >5x speedup"; pass++; System.out.printf("%d/3 PASS — pylons-0001..0003: CWE-407 in TopologicalSorter (Pylons/Pyramid util.py)%n", pass); System.out.printf("Hotpaths: add(), sorted(), remove() — called during config/tweens/predicates/derivers setup%n"); } }