java-topology/whitepaper/outreach/rclone-0003.md

rclone — CWE-407 Disclosure Brief (rclone-0003)

2026-04-13 · Patch available — awaiting upstream merge

Finding

O(P²) permission sorting in OneDrive metadata sortPermissions() where slices.ContainsFunc and slices.Contains scan permission lists for every old and new permission entry.

The Defect

rclone-0003 (PATCHED — MEDIUM): backend/onedrive/metadata.go:432

for _, n := range new {
    // O(P) scan per new permission:
    if !slices.ContainsFunc(old, func(o *api.PermissionsType) bool {
        return o.ID == n.ID && slices.Compare(o.Roles, n.Roles) != 0 && ...
    }) { ... }
}
for _, o := range old {
    // O(P) scan per old permission:
    newHasOld := slices.ContainsFunc(new, func(n *api.PermissionsType) bool { ... })
    if !newHasOld && !slices.Contains(add, o) && !slices.Contains(update, o) { ... }
}

Multiple slices.ContainsFunc and slices.Contains calls inside loops give O(P²) total where P = permissions per file.

Complexity Proof

At P=500 permissions (large SharePoint site):

• Defective: ~500 × 500 × 3 = 750,000 comparisons
• Fixed: 500 × 3 map operations = 1,500 operations
• ~500× op reduction.

Impact

rclone syncs OneDrive/SharePoint files with --metadata for permission preservation. SharePoint document libraries with fine-grained permissions (per-user/per-group access on hundreds of documents) trigger this path for every file synced. Large enterprise migrations with millions of files compound the per-file overhead.

The Fix

Build oldByID and newByID maps plus addSet and updateSet for O(1) lookups:

oldByID := make(map[string]*api.PermissionsType, len(old))
for _, o := range old { oldByID[o.ID] = o }
// ...
o, exists := oldByID[n.ID]  // O(1)

Patch

Fix available: defects/rclone-0003/patch/sort_permissions_map.patch

Single-file patch in metadata.go.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (rclone/rclone).
2. Assess severity — fires per file with --metadata, compounds across large syncs.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit the rclone team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.