36 lines
1.8 KiB
Diff
36 lines
1.8 KiB
Diff
# UNDF: UNDF-2026-000000014
|
||
Fixes bottle-0001: Route.all_plugins() — skiplist is a list, scanned 4× per plugin iteration.
|
||
|
||
--- a/bottle.py
|
||
+++ b/bottle.py
|
||
|
||
@@ DEFECT bottle-0001: Route.__init__() line 490 + Route.all_plugins() lines 516-519
|
||
|
||
class Route(object):
|
||
def __init__(self, app, rule, method, callback,
|
||
name=None, plugins=None, skiplist=None, **config):
|
||
...
|
||
- self.skiplist = skiplist or [] # list — O(n) scans — CWE-407
|
||
+ self.skiplist = set(skiplist) if skiplist else set() # FIX: set for O(1) lookups
|
||
|
||
def all_plugins(self):
|
||
""" Yield all Plugins affecting this route. """
|
||
unique = set()
|
||
for p in reversed(self.app.plugins + self.plugins):
|
||
- if True in self.skiplist: break # O(n) list scan — CWE-407
|
||
+ if True in self.skiplist: break # O(1) set lookup — fixed (True is hashable)
|
||
name = getattr(p, 'name', False)
|
||
- if name and (name in self.skiplist or name in unique): continue # O(n) list scan × 2 — CWE-407
|
||
+ if name and (name in self.skiplist or name in unique): continue # O(1) — fixed
|
||
- if p in self.skiplist or type(p) in self.skiplist: continue # O(n) list scan × 2 — CWE-407
|
||
+ if p in self.skiplist or type(p) in self.skiplist: continue # O(1) — fixed
|
||
if name: unique.add(name)
|
||
yield p
|
||
|
||
# SUMMARY: 4 list membership tests per plugin iteration → 4 O(1) set lookups.
|
||
# Total complexity: O((P+R) × S) → O(P+R) per route compilation.
|
||
# Cache busting on install(): O(N³) startup with N plugins → O(N²).
|
||
#
|
||
# NOTE: All membership patterns are hashability-safe:
|
||
# True is hashable; plugin names are strings; plugin objects are hashable
|
||
# by identity; type() is always hashable. Set conversion is drop-in safe.
|