UNDF: UNDF-2026-000000367

consul-0001: ExcludeBasedOnChecks — O(checks × ignoreIDs)

CWE

CWE-407: Inefficient Algorithmic Complexity

Severity

MEDIUM

Location

agent/structs/structs.go:2244-2252

Description

ExcludeBasedOnChecks iterates over all checks for a service node and for each calls slices.Contains(opts.IgnoreCheckIDs, check.CheckID) — a linear scan over the ignore list.

for _, check := range csn.Checks {
    if slices.Contains(opts.IgnoreCheckIDs, check.CheckID) {   // O(|IgnoreCheckIDs|)
        continue
    }
    ...
}

This function is called in health query hot paths (service discovery). With C checks per node and I ignore IDs: O(C × I) per node, compounded over all nodes returned in a health query.

Fix

Build a map[types.CheckID]struct{} from opts.IgnoreCheckIDs once (either in the caller or at the start of the function).

Speedup

~Ix where I = len(IgnoreCheckIDs).

941 B Raw Permalink Blame History Unescape Escape