java-topology/defects/maven/patch/maven-0005-build-plan-logger-sorted-nodes-index-map.patch

28 lines
1.6 KiB
Diff

# UNDF: UNDF-2026-000000166
diff --git a/impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/concurrent/BuildPlanLogger.java b/impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/concurrent/BuildPlanLogger.java
--- a/impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/concurrent/BuildPlanLogger.java
+++ b/impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/concurrent/BuildPlanLogger.java
@@ -21,6 +21,8 @@ package org.apache.maven.lifecycle.internal.concurrent;
import java.util.Comparator;
import java.util.HashSet;
+import java.util.IdentityHashMap;
+import java.util.Map;
import java.util.List;
import java.util.Optional;
import java.util.Set;
@@ -74,8 +76,13 @@ public class BuildPlanLogger {
} else {
+ // CWE-407 fix: plan.sortedNodes()::indexOf is O(N) per step → O(N²) total for the
+ // stream sorted() call over N steps. Build an O(1) index map once.
+ List<BuildStep> sorted = plan.sortedNodes();
+ Map<BuildStep, Integer> indexMap = new IdentityHashMap<>(sorted.size() * 2);
+ for (int i = 0; i < sorted.size(); i++) {
+ indexMap.put(sorted.get(i), i);
+ }
plan.steps(project)
.filter(step ->
step.phase != null && step.executions().findAny().isPresent())
- .sorted(Comparator.comparingInt(plan.sortedNodes()::indexOf))
+ .sorted(Comparator.comparingInt(step -> indexMap.getOrDefault(step, Integer.MAX_VALUE)))
.forEach(step -> {