jitsi-videobridge (Kotlin/Java video conferencing bridge):
- 0001: Prioritize.kt selectedSourceNames.contains()+indexOf() inside forEach over conferenceSources, O(C*S)
- 0002: BandwidthAllocator.kt selectedSources getter List.contains() dedup inside forEach, O(S^2)
- 0003: ConferenceSpeechActivity.java endpointsChanged() ArrayList.contains() in removeIf+for loop, O(E^2)
Fix: HashSet for O(1) membership; pre-built index map for indexOf
Unit test: 4/4 PASS, 19-35x op-count reduction at N=200
woodpecker-0001 (Go CI/CD pipeline step builder):
- filterItemsWithMissingDependencies() calls containsItemWithName() (O(N) linear scan) inside
two nested loops over items and deps: O(N*D*N) = O(N^2)
Fix: pre-build name-set map for O(1) lookup, O(N) total
Unit test: 3/3 PASS, 20x op-count reduction at N=100
woodpecker-0002 (CWE-312 credential logging):
- shared/token/token.go ParseRequest() logs raw Authorization header value at Trace level:
log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
Exposes full Bearer JWT token in application logs
Fix: log only that header was found, not its value
Unit test: 3/3 PASS
russell@unturf.com
1e10775b90