russell@unturf.com
7af6b9c89f
UNDF-2026-000000468: three.js src/nodes/core/Node.js:351 traverse() recurses without a visited set; on shared-node (diamond) TSL shader graphs yields 2^D callback invocations. D=10 gives 4093× overhead. Fix: add optional visited Set parameter, default new Set() at root call. Unit test: 10/10 PASS (ThreeJSNodeTraverseTest.java) CLEAN markers written for: webpack (visitedModules WeakSet throughout), valhalla (Dijkstra+BFS, no recursive DAG traversal), traefik (traverse() has proper visited map), wasmer (petgraph+BTreeMap), wasmtime (SCC algorithms).
18 lines
1.2 KiB
Markdown
18 lines
1.2 KiB
Markdown
## Diamond Recursion Scan (webpack) — CLEAN
|
|
|
|
**Scan date:** 2026-03-29
|
|
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
|
|
|
|
### Files examined
|
|
|
|
- `lib/container/HoistContainerReferencesPlugin.js` — `getAllReferencedModules()` — uses `WeakSet visitedModules`, iterative BFS. CLEAN.
|
|
- `lib/ExportsInfo.js` — `_findTarget()`, `_getTarget()`, `_updateHash()` — each passes `alreadyVisited` Set through recursion. CLEAN.
|
|
- `lib/buildChunkGraph.js` — iterative queue-based BFS, no recursion. CLEAN.
|
|
- `lib/ChunkGroup.js` — `getChildren()`/`getParents()` — backed by `Set`-based data structure. CLEAN.
|
|
- `lib/optimize/SideEffectsFlagPlugin.js` — uses `Set<Module>` for dedup. CLEAN.
|
|
- `lib/Compilation.js` — `_handleModuleBuildAndDependencies()` uses `creatingModuleDuringBuild: Map<Module, Set<Module>>` for cycle detection. CLEAN.
|
|
- `lib/optimize/ConcatenatedModule.js` — no recursive graph traversal. CLEAN.
|
|
|
|
### Verdict: CLEAN — no diamond recursion CWE-407 found in webpack
|
|
|
|
webpack uses proper visited Sets/WeakSets and iterative BFS throughout its module dependency traversal code. Prior defects (webpack-0001/0002) are O(N²) list-scan patterns in HMR, already patched.
|