29 lines
1.3 KiB
Diff
29 lines
1.3 KiB
Diff
# UNDF: UNDF-2026-000000328
|
|
From 0000000 Mon Sep 17 00:00:00 2001
|
|
Subject: [PATCH] acl: replace selector->patterns/channels lists with dicts for O(1) dedup
|
|
|
|
CWE-407: ACLSetSelector performs O(P) listSearchKey to deduplicate key
|
|
patterns when adding each ~<pattern> rule. When N rules are applied in
|
|
sequence (e.g., ACL SETUSER user ~p1 ~p2 ... ~pN), total cost is
|
|
O(1+2+...+N) = O(N²). Same defect applies to &<channel> rules using
|
|
selector->channels.
|
|
|
|
Trigger: ACL SETUSER myuser ~key:1 ~key:2 ... ~key:N
|
|
ACL SETUSER myuser &ch:1 &ch:2 ... &ch:N
|
|
ACL file load with many per-selector key/channel rules
|
|
|
|
Severity: MEDIUM
|
|
- Directly controllable by any client with ACL SETUSER permission
|
|
- N=500 key patterns → 125,000 comparisons per SETUSER call
|
|
- N=1000 → 500,000 comparisons
|
|
|
|
Affected files: src/acl.c:1217 (listSearchKey selector->patterns)
|
|
src/acl.c:1236 (listSearchKey selector->channels)
|
|
|
|
This is the same CWE-407 defect as Redis (Valkey is a fork; same code).
|
|
|
|
Fix: see redis-0003 patch — replace listSearchKey with dictFind using
|
|
a parallel sds-keyed dict maintained on aclSelector.
|
|
|
|
Speedup: O(N²) → O(N). N=500 patterns: 125,000 → 500 comparisons (250x).
|
|
N=1000 patterns: 500,000 → 1,000 comparisons (500x).
|