java-topology/whitepaper/outreach/drone-0001.md

Drone — CWE-407 Disclosure Brief (drone-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(S*T) linear-scan defect in Drone CI's in-memory pub/sub system. Patched. Patch ready for upstream review.

The Defects

drone-0001 (PATCHED — MEDIUM): pubsub/inmem.go:91

// In Publish() and Subscribe() — fires on every message publish:
if slices.Contains(sub.topics, topic) && !sub.isClosed() {
// Subscribe:
if slices.Contains(s.topics, ch) {
    continue
}
s.topics = append(s.topics, ch)

sub.topics is a []string slice. slices.Contains performs O(T) linear scan for each subscriber on every publish. With S subscribers and T topics per subscriber, each publish costs O(S*T).

Complexity Proof

At S=100 subscribers, T=50 topics each:

• Defective: 100 x 50 = 5,000 comparisons per publish
• Fixed: 100 x 1 = 100 lookups (map)
• 50x op reduction per publish.

Impact

Drone CI uses this in-memory pub/sub for real-time build log streaming. High-concurrency CI environments with many simultaneous builds and subscribers pay increasing per-message costs.

The Fix

Add a map[string]struct{} shadow set alongside the topics slice:

// Before
slices.Contains(sub.topics, topic)

// After
_, ok := sub.topicSet[topic]

Patch

Fix available: defects/drone-0001/patch/drone-0001.patch

Single-file patch on pubsub/inmem.go. 50x speedup at S=100 subscribers, T=50 topics.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (harness/drone).
2. Assess severity — fires on every pub/sub message; scales with subscriber and topic count.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Drone team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.