russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.3 KiB

Raw Permalink Blame History

Jitsi Meet — CWE-407 Disclosure Brief (jitsi-meet-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Jitsi Meet's connection stats display. The ConnectionStatsTable component uses Array.includes() for deduplication of transport data (IPs, ports, transport types), producing O(T²) total cost where T = transport entries.

The Defect

jitsi-meet-0001 (PATCHED — LOW): react/features/connection-stats/components/ConnectionStatsTable.tsx:438

for (let i = 0; i < transport.length; i++) {
    if (!data.remoteIP.includes(ip)) {       // O(N) per iteration
        data.remoteIP.push(ip);
    }
    if (!data.localIP.includes(localIP)) {    // O(N) per iteration
        data.localIP.push(localIP);
    }
    // ... same pattern for localPort, remotePort, transportType
}

Five Array.includes() calls per transport entry, each scanning growing arrays. With T transport entries, total comparisons reach O(5*T²/2).

Complexity Proof

At T=50 transport entries:

Defective: 5 × 50 × 25 (avg) = 6,250 comparisons
Fixed: 5 × 50 Set lookups = 250 operations
~25× op reduction.

Impact

Jitsi Meet displays connection statistics in the UI. The transport dedup fires on every stats update for every participant connection. While transport lists are typically small, the fix eliminates unnecessary quadratic scaling.

The Fix

Add companion Set<string> for each data category for O(1) dedup:

const seenRemoteIP = new Set<string>();
// ... in loop:
if (!seenRemoteIP.has(ip)) {
    seenRemoteIP.add(ip);
    data.remoteIP.push(ip);
}

Patch

Fix available: defects/jitsi-meet-0001/patch/jitsi-meet-0001-transport-dedup.patch

Single-file patch in ConnectionStatsTable.tsx. Adds five Set<string> companions. ~25× speedup at 50 transports.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (jitsi/jitsi-meet).
Assess severity — fires on every connection stats update.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Jitsi team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Permalink Blame History Unescape Escape