java-topology/whitepaper/outreach/cura-0001.md

Ultimaker Cura — CWE-407 Disclosure Brief (cura-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(P²) defect in Ultimaker Cura in the compatible machine model. A list comprehension rebuilds and scans linearly inside a per-printer loop on every machine manager update event. Patched.

The Defects

cura-0001 (PATCHED — LOW-MEDIUM): cura/Machines/Models/CompatibleMachineModel.py:55

# In _update — fires on every machine manager change event:
for output_device in machine_manager.printerOutputDevices:
    for printer in output_device.printers:
        if printer.name in [item["name"] for item in self.items]:  # O(I) rebuilt per printer
            continue

Each printer iteration rebuilds [item["name"] for item in self.items] from scratch and scans it linearly. With P printers and I already-added items, cost per update: O(P × I). For a print farm with 50 printers: O(50 × 50) = 2,500 operations where O(1) amortized suffices.

Complexity Proof

At P=50 printers, I=50 items:

• Defective: 50 × 50 = 2,500 list constructions + comparisons
• Fixed: 50 + 50 = 100 set operations
• 25× op reduction.

Impact

Ultimaker Cura serves hundreds of thousands of 3D printing users. The compatible machine model updates on output device changes and global container changes. Print farm environments with many networked printers trigger frequent updates. Every status refresh re-pays the quadratic cost, adding latency to the printer selection UI.

The Fix

Build a set once before the loop:

# Before
if printer.name in [item["name"] for item in self.items]:

# After — O(1) membership
seen_printer_names = {item["name"] for item in self.items}
if printer.name in seen_printer_names:
    continue
seen_printer_names.add(printer.name)

Patch

Fix available: defects/cura-0001/patch/cura-0001-compatible-machine-model-list-rebuild.patch

Single-file patch in CompatibleMachineModel.py.

Unit test: pass. 25× speedup at 50 printers.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (Ultimaker/Cura).
2. Assess severity — fires on every machine manager update in print farm environments.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Ultimaker team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.