18 lines
1.1 KiB
Diff
18 lines
1.1 KiB
Diff
# UNDF: UNDF-2026-000000860
|
|
--- a/apps/web/src/TextForEvent.tsx
|
|
+++ b/apps/web/src/TextForEvent.tsx
|
|
@@ -394,8 +394,11 @@ function textForCanonicalAliasEvent(ev: MatrixEvent): (() => string) | null {
|
|
const oldAltAliases = ev.getPrevContent().alt_aliases || [];
|
|
const newAlias = ev.getContent().alias;
|
|
const newAltAliases = ev.getContent().alt_aliases || [];
|
|
- const removedAltAliases = oldAltAliases.filter((alias: string) => !newAltAliases.includes(alias));
|
|
- const addedAltAliases = newAltAliases.filter((alias: string) => !oldAltAliases.includes(alias));
|
|
+ // CWE-407 fix: use Set for O(1) membership test; avoids O(A*B) from
|
|
+ // includes() inside filter() when computing alias diffs.
|
|
+ const newAltAliasSet = new Set(newAltAliases);
|
|
+ const oldAltAliasSet = new Set(oldAltAliases);
|
|
+ const removedAltAliases = oldAltAliases.filter((alias: string) => !newAltAliasSet.has(alias));
|
|
+ const addedAltAliases = newAltAliases.filter((alias: string) => !oldAltAliasSet.has(alias));
|
|
|
|
if (!removedAltAliases.length && !addedAltAliases.length) {
|
|
if (newAlias) {
|