russell@unturf.com
c2a1fc15cc
btcpayserver-0001: WalletTransactionInfo.Merge Attachments.Any O(A*B) MEDIUM btcpayserver-0002: AppService gap-fill series.All O(D*S) LOW-MEDIUM btcpayserver-0003: StringExtensions.IsValidFileName GetInvalidFileNameChars O(F*I) MEDIUM
26 lines
1.2 KiB
Diff
26 lines
1.2 KiB
Diff
# UNDF: UNDF-2026-000000930
|
|
--- a/BTCPayServer.Abstractions/Extensions/StringExtensions.cs
|
|
+++ b/BTCPayServer.Abstractions/Extensions/StringExtensions.cs
|
|
@@ -1,4 +1,5 @@
|
|
using System;
|
|
+using System.Collections.Generic;
|
|
using System.IO;
|
|
using System.Linq;
|
|
|
|
@@ -6,9 +7,16 @@
|
|
|
|
public static class StringExtensions
|
|
{
|
|
+ // CWE-407: Path.GetInvalidFileNameChars() allocates a new char[] on every call.
|
|
+ // Contains() on char[] is O(I) per character. For a filename of length F, this
|
|
+ // is O(F * I) with I = ~41 invalid chars, plus F array allocations.
|
|
+ // Fix: cache in a static HashSet<char> for O(1) lookup and zero allocation.
|
|
+ private static readonly HashSet<char> InvalidFileNameChars = new HashSet<char>(Path.GetInvalidFileNameChars());
|
|
+
|
|
public static bool IsValidFileName(this string fileName)
|
|
{
|
|
- return !fileName.ToCharArray().Any(c => Path.GetInvalidFileNameChars().Contains(c)
|
|
+ return !fileName.ToCharArray().Any(c => InvalidFileNameChars.Contains(c)
|
|
|| c == Path.AltDirectorySeparatorChar
|
|
|| c == Path.DirectorySeparatorChar
|
|
|| c == Path.PathSeparator
|