engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/tools/tickets/scans/minecraft-server.md
russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems 
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00

2.6 KiB
Raw Permalink Blame History

id repo version scanned source method
scan/minecraft-server Mojang/minecraft-java-edition 26.1 (server-26.1.jar, extracted from server.jar bundler) 2026-03-24 ~/Downloads/server.jar (bundler) → META-INF/versions/26.1/server-26.1.jar CFR decompiler + bytecode string scan for List/contains patterns

Summary

7,351 classes scanned. 2 confirmed defects. Core graph utilities are CLEAN.

Confirmed defects

ID Class Pattern Severity
minecraft-0001 util/DependencySorter.isCyclic Recursive DFS with no visited set — exponential on diamond dependency graphs HIGH
minecraft-0002 world/level/block/piston/PistonStructureResolver List<BlockPos>.contains() in push chain loop LOW (bounded at 12)

Confirmed CLEAN

Class Why clean
util/Graph.depthFirstSearch Uses Set<T> for both discovered and currentlyVisiting — O(1) contains
util/FeatureSorter Uses TreeSet for visited/onStack — O(log n), deliberate for deterministic ordering
util/DependencySorter.visitDependenciesAndElement Uses HashSet alreadyVisited — O(1)
world/level/lighting/DynamicGraphMinFixedPoint No list containers in bytecode
world/level/chunk/status/ChunkDependencies No list containers in bytecode

Notes

  • Minecraft Java Edition is NOT open source. Analysis is from decompiled bytecode.
  • CFR decompiler used (cfr-0.152.jar).
  • Obfuscated field/method names are NOT remapped (no mappings applied). Class names are unobfuscated in recent versions (Mojang releases class name mappings).
  • Disclosure path: bugs.mojang.com (public bug tracker).

minecraft-0001 detail

DependencySorter.isCyclic performs a recursive DFS to check if adding an edge would create a cycle. No visited set. For a diamond graph of depth D, node count is 2^D. Called from TagLoader — runs on every world load and /reload.

Large modpacks (Create, Applied Energistics 2, Mekanism, Thermal Expansion) with thousands of cross-mod tag dependencies hit this on every server start. The "tag loading lag" reported by modpack server operators is consistent with this behavior.

Broader scan note

34 classes had the ArrayList + contains bytecode signature. Most are either:

  • Bounded inputs (piston: max 12, pack selection: tens of packs)
  • Non-hot paths (advancement layout, crash report categories)
  • Using contains on a HolderSet (Minecraft's own set wrapper, likely O(1))

The DependencySorter defect is the only site where unbounded graph traversal occurs without visited tracking.