russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.5 KiB

Raw Permalink Blame History

IPFS Cluster — CWE-407 Disclosure Brief (ipfs-cluster-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in IPFS Cluster's metric filtering. The filterMetrics() method in allocate.go uses containsPeer() (a linear scan helper) to classify peers against blacklist, currentAllocs, and priorityList slices, producing O(M*(B+A+P)) total cost per allocation.

The Defect

ipfs-cluster-0001 (PATCHED — MEDIUM): allocate.go:123 in filterMetrics()

for _, metrics := range mSet {
    for _, m := range metrics {
        switch {
        case containsPeer(blacklist, m.Peer):       // O(B) per metric
        case containsPeer(currentAllocs, m.Peer):   // O(A) per metric
        case containsPeer(priorityList, m.Peer):    // O(P) per metric
        }
    }
}

containsPeer() is a linear scan over a []peer.ID slice. For each metric across all informers, three linear scans fire. With M metrics and B+A+P total peers in the classification lists, total cost reaches O(M*(B+A+P)).

Complexity Proof

At M=500 metrics, B=50 blacklisted, A=100 allocated, P=50 priority:

Defective: 500 × (50+100+50) = 100,000 comparisons
Fixed: 500 × 3 map lookups = 1,500 operations
~67× op reduction.

Impact

IPFS Cluster coordinates pin replication across IPFS nodes. Metric filtering fires on every pin allocation decision. Large clusters with hundreds of peers and frequent pinning operations hit this path repeatedly.

The Fix

Build map[peer.ID]struct{} sets from blacklist, currentAllocs, and priorityList once, then use O(1) map lookups:

// After
blacklistSet := make(map[peer.ID]struct{}, len(blacklist))
for _, p := range blacklist { blacklistSet[p] = struct{}{} }
// ... same for currentAllocsSet, prioritySet
case peerInSet(blacklistSet, m.Peer):  // O(1)

Patch

Fix available: defects/ipfs-cluster-0001/patch/ipfs-cluster-0001.patch

Two-file patch in allocate.go and util.go. Adds peerInSet() helper using map lookup. ~67× speedup at 200 classification peers.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (ipfs-cluster/ipfs-cluster).
Assess severity — fires on every pin allocation decision.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the IPFS Cluster team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Permalink Blame History Unescape Escape