25 lines
1.1 KiB
Diff
25 lines
1.1 KiB
Diff
# UNDF: UNDF-2026-000000857
|
|
# UNDF: (leave blank)
|
|
# CWE-407: Project#members_among user_ids Array#include? in select loop
|
|
# Severity: MEDIUM
|
|
# Speedup: ~100x at U=200 users, A=500 authorized user IDs
|
|
# File: app/models/project.rb
|
|
# The members_among method fetches authorized user IDs via pluck(:id)
|
|
# into an Array, then filters the input users collection with
|
|
# users.select { |user| user_ids.include?(user.id) }. Each include?
|
|
# is O(A) where A = number of authorized user IDs. Called for each
|
|
# of U input users. Total: O(U * A). On large projects with many
|
|
# authorized users, A can be thousands.
|
|
# Fix: convert user_ids to a Set for O(1) lookup.
|
|
--- a/app/models/project.rb
|
|
+++ b/app/models/project.rb
|
|
@@ -2498,8 +2498,8 @@ class Project < ApplicationRecord
|
|
else
|
|
return [] if users.empty?
|
|
|
|
- user_ids = authorized_users.where(users: { id: users.map(&:id) }).pluck(:id)
|
|
- users.select { |user| user_ids.include?(user.id) }
|
|
+ user_ids = authorized_users.where(users: { id: users.map(&:id) }).pluck(:id).to_set
|
|
+ users.select { |user| user_ids.member?(user.id) }
|
|
end
|
|
end
|