russell@unturf.com
b71284e245
scribus-0004: scribus{150,170,171}format_save.cpp writes styles via
names.contains() on QList<QString> (from QMap::keys()) inside O(S) loop
— O(S²) per save. Fix: use lists.charStyles().contains() (QMap, O(log N))
directly. 6 defect sites across 3 format variants. 375x at N=1000.
darktable: 5-MOAD scan complete (darktable-0001..0005 + MOAD-0002/0003/0005
CLEAN already committed). No new defects found beyond prior scan.
SCAN-TODO: mark both targets as scanned with summary.
40 lines
1.9 KiB
Markdown
40 lines
1.9 KiB
Markdown
# UNDF: UNDF-2026-000000802
|
||
# Scribus — 5-MOAD Scan Result
|
||
|
||
Scanned: 2026-04-01
|
||
Clone: https://github.com/scribusproject/scribus (depth=1)
|
||
|
||
## MOAD-0001 (CWE-407): 4 defects — PATCHED (scribus-0001/0002/0003/0004)
|
||
|
||
- scribus-0001: `getSortedStyleList` / `getSortedCharStyleList` / `getSortedTableStyleList` /
|
||
`getSortedCellStyleList` — `QList<int>::contains()` inside O(S) loop → O(S²).
|
||
Fix: companion `QSet<int>` for O(1) membership.
|
||
- scribus-0002: `getUsedPatterns` — `results.contains()` inside O(I×R) loop.
|
||
- scribus-0003: `Selection::addItems` — `m_SelList.contains()` inside O(N×M) loop.
|
||
- scribus-0004: file savers (`scribus150/170/171format_save.cpp`) — `names.contains()` on
|
||
`QList<QString>` (from QMap::keys()) inside O(S) style-write loop → O(S²) per save.
|
||
6 defect sites across 3 format variants. Fix: use `lists.charStyles().contains()` (QMap,
|
||
O(log N)) directly instead of materialising a QList for linear scan. 375x at N=1000.
|
||
|
||
## MOAD-0002 (Intertangle): CLEAN
|
||
|
||
No shared mutable global god object coupling independent subsystems found.
|
||
`ScribusApp` and `ScribusDoc` are well-separated; document state is per-instance.
|
||
|
||
## MOAD-0003 (Leaked Context): CLEAN
|
||
|
||
No `thread_local` or `QThreadStorage` holding request-scoped document identity found.
|
||
Document context is passed explicitly through function parameters and pointers.
|
||
|
||
## MOAD-0004 (CWE-312): CLEAN
|
||
|
||
No network credential (password, auth token) logging found.
|
||
Scribus does not include networking features that authenticate over HTTP/SMTP/LDAP;
|
||
no logger calls adjacent to authentication credential handling were found.
|
||
|
||
## MOAD-0005 (Thundering Herd): CLEAN
|
||
|
||
No concurrent cache get+null+compute+put without synchronization found.
|
||
`ScImageCacheManager` uses file-level locking (`m_writeLockFile`) rather than
|
||
in-memory unsynchronized cache patterns; no `QCache` or similar structure exposed
|
||
to concurrent write without lock.
|