engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/tools/tickets/defects/maven-0002.md
russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems 
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00

1.3 KiB
Raw Permalink Blame History

id repo severity status created patched patch
maven-0002 maven HIGH PATCHED 2026-03-23 2026-03-23 defects/maven/patch/maven-0001-0002-vertex-linkedhashset.patch

Defect

File: maven-core/src/main/java/org/apache/maven/internal/impl/Graph.java:63-64 Pattern: duplicate of maven-0001 in different package, ArrayList.remove() in removeEdge Complexity: O(n) per edge removal Language: Java

Description

This is a duplicate of the same defect present in maven-0001, replicated in the maven.internal.impl package. The Graph class in the internal implementation package independently reimplements the same adjacency-list edge removal using ArrayList.remove(Object). Both copies were likely derived from the same source and carry the same O(n) linear scan defect per edge removal.

Fix

Replace: adjacencyList.remove(edge) With: adjacencySet.remove(edge) Data structure change: ArrayList<String> edges → LinkedHashSet<String> edges

Work required

  • Patch in defects/maven/patch/
  • Unit test — asserts exact operation counts before/after (in defects/maven/unit/)
  • Integration test (in defects/maven/integration/)
  • Benchmark — before/after on V=100,200,400,800 (in defects/maven/bench/)
  • White paper section