41 lines
2.2 KiB
Diff
41 lines
2.2 KiB
Diff
# UNDF: UNDF-2026-000000005
|
|
From: agent-blackops <blackops@unturf.com>
|
|
Date: Thu, 26 Mar 2026 00:00:00 +0000
|
|
Subject: [PATCH] playbook/role: replace seen list with identity-keyed set in get_vars()
|
|
|
|
CWE-407: Algorithmic complexity via O(D^2) linear scan deduplication in
|
|
get_vars(). `seen` was a plain list used for membership testing inside
|
|
an O(D) outer loop over get_all_dependencies(), producing O(D^2) total
|
|
equality comparisons when D transitive dependencies exist.
|
|
|
|
Role defines __eq__ for value-based comparison but not __hash__, so a
|
|
plain set() would raise TypeError at runtime. Fix: use id(dep) as the
|
|
identity key — a parallel seen_ids set of integers gives O(1) average
|
|
membership test and insertion. The TODO comment in the source already
|
|
flagged this: "re-examine dep loading to see if we are somehow
|
|
improperly adding the same dep too many times."
|
|
|
|
Defect-Id: ANS-001
|
|
Severity: MEDIUM
|
|
CWE: CWE-407 (Inefficient Algorithmic Complexity)
|
|
---
|
|
lib/ansible/playbook/role/__init__.py | 8 ++++----
|
|
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/lib/ansible/playbook/role/__init__.py b/lib/ansible/playbook/role/__init__.py
|
|
index xxxxxxx..yyyyyyy 100644
|
|
--- a/lib/ansible/playbook/role/__init__.py
|
|
+++ b/lib/ansible/playbook/role/__init__.py
|
|
@@ -536,11 +536,11 @@ class Role(Base, Become, Conditional, Taggable, Delegatable):
|
|
# get exported variables from meta/dependencies
|
|
- seen = []
|
|
+ seen_ids = set() # CWE-407 fix: O(1) identity set
|
|
for dep in self.get_all_dependencies():
|
|
# Avoid rerunning dupe deps since they can have vars from previous invocations and they accumulate in deps
|
|
# TODO: re-examine dep loading to see if we are somehow improperly adding the same dep too many times
|
|
- if dep not in seen:
|
|
+ if id(dep) not in seen_ids: # CWE-407 fix: O(1) vs O(D)
|
|
# only take 'exportable' vars from deps
|
|
all_vars = combine_vars(all_vars, dep.get_vars(include_params=False, only_exports=True))
|
|
- seen.append(dep)
|
|
+ seen_ids.add(id(dep)) # CWE-407 fix: O(1)
|