java-topology/whitepaper/outreach/onlyoffice-0001.md

ONLYOFFICE — CWE-407 Disclosure Brief (onlyoffice-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Multiple O(R × N) defects in ONLYOFFICE Document Editor's table operations. Patched. Several table manipulation methods use Array.indexOf() for row/cell membership checks inside loops, producing quadratic behavior during table selection and splitting.

The Defects

onlyoffice-0001 (PATCHED — MEDIUM): word/Editor/Table.js

Seven call sites share the same pattern:

// In SelectCells, VertSplitCells, CalculateNewRowsInfo, HorSplitCells,
// GetAffectedCells, CalculateNewRowsInfoByRowsIndices:
for (var curRow = 0; curRow < this.Get_RowsCount(); curRow++) {
    if (Rows.indexOf(curRow) != -1) {  // O(R) per row
        // process row
    }
}

Rows / RowsIndices / CellsIndexes are plain Arrays. indexOf() is O(R) per call. Inside a loop over all rows, total cost: O(rows × R) per operation.

Complexity Proof

At rows=500 rows, R=100 selected rows:

• Defective: 500 × 100 = 50,000 comparisons per operation
• Fixed: 500 × O(1) = 500 Set lookups per operation
• 100× op reduction per table operation.

Impact

ONLYOFFICE is a popular open-source office suite. Table operations (selection, splitting, row info calculation) fire during user interaction with document tables. Large tables with many rows and complex selections trigger quadratic overhead, causing UI lag during table editing.

The Fix

Convert arrays to Sets before the loop:

// Before
if (Rows.indexOf(curRow) != -1)  // O(R)

// After
var RowsSet = new Set(Rows);
if (RowsSet.has(curRow))         // O(1)

Patch

Fix available: defects/onlyoffice-0001/patch/onlyoffice-0001.patch

Touches word/Editor/Table.js. Seven call sites fixed with new Set(). 100× speedup at 500 rows / 100 selected.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (ONLYOFFICE/DocumentServer).
2. Assess severity — fires during table editing operations.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the ONLYOFFICE team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.