java-topology/defects/zookeeper/patch/zookeeper-0001-acl-dedup-hashset.patch

25 lines
1 KiB
Diff

# UNDF: UNDF-2026-000000343
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -24,6 +24,7 @@
import java.util.Collections;
import java.util.HashMap;
+import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Locale;
@@ -948,11 +949,12 @@
- // This would be done better with a Set but ACL hashcode/equals do not
- // allow for null values
- final ArrayList<ACL> retval = new ArrayList<>(acls.size());
+ // CWE-407 fix: parallel HashSet for O(1) membership test instead of O(N) ArrayList.contains
+ final List<ACL> retval = new ArrayList<>(acls.size());
+ final Set<ACL> seen = new HashSet<>(acls.size());
for (final ACL acl : acls) {
- if (!retval.contains(acl)) {
- retval.add(acl);
+ if (seen.add(acl)) {
+ retval.add(acl);
}
}
return retval;