russell@unturf.com
15db2a0269
synapse/handlers/sync.py _get_rooms_changed: newly_joined_rooms is List[str] checked with `in` inside for-loop over all joined rooms (line 2252). O(J*N) where J=joined rooms, N=newly joined. Fix: use Set. 99x at J=5000.
24 lines
997 B
Markdown
24 lines
997 B
Markdown
# matrix-js-sdk — CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned: 2026-03-30
|
|
Source: https://github.com/matrix-org/matrix-js-sdk (depth=1)
|
|
|
|
## Scan Coverage
|
|
- `src/models/room.ts` — room timeline, member list, thread notifications
|
|
- `src/models/room-state.ts` — member filtering
|
|
- `src/sync.ts` — sync processing, toDevice event handling
|
|
- `src/filter-component.ts` — event filter evaluation
|
|
- `src/client.ts` — client-level operations
|
|
- `src/models/event-timeline-set.ts` — timeline event dedup
|
|
- `src/crypto/` — device tracking, key verification
|
|
|
|
## Findings
|
|
All `.includes()` / `.indexOf()` calls found are on:
|
|
- Small constant arrays (enum value checks, 2-5 elements)
|
|
- `functionalMembers` (service member IDs, typically 0-2)
|
|
- `excludedIds` (small exclusion lists)
|
|
- `cancelledKeyVerificationTxns` (bounded by single sync response)
|
|
|
|
No O(N^2) patterns found in hot paths. The codebase correctly uses
|
|
Map/Set for large collections and only uses Array.includes() on small,
|
|
bounded arrays.
|