engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/tools/tickets/defects/maven-0001.md
russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems 
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00

1.2 KiB
Raw Permalink Blame History

id repo severity status created patched patch
maven-0001 maven HIGH PATCHED 2026-03-23 2026-03-23 defects/maven/patch/maven-0001-0002-vertex-linkedhashset.patch

Defect

File: maven-core/src/main/java/org/apache/maven/project/Graph.java:63-64 Pattern: ArrayList.remove() in removeEdge Complexity: O(n) per edge removal Language: Java

Description

Graph.removeEdge uses ArrayList.remove(Object) to delete an edge from an adjacency list. ArrayList.remove performs a linear scan to find the element before removing it, shifting subsequent elements. During project graph construction and modification, removeEdge may be called many times, and each call pays the O(n) scan cost, making bulk edge removal O(n²) in the number of edges.

Fix

Replace: adjacencyList.remove(edge) With: adjacencySet.remove(edge) Data structure change: ArrayList<String> edges → LinkedHashSet<String> edges

Work required

  • Patch in defects/maven/patch/
  • Unit test — asserts exact operation counts before/after (in defects/maven/unit/)
  • Integration test (in defects/maven/integration/)
  • Benchmark — before/after on V=100,200,400,800 (in defects/maven/bench/)
  • White paper section