russell@unturf.com
689ec25d05
grafana-0001: getDashboardsSharedWithUser dashboard UID dedup O(P^2) MEDIUM 2.5x grafana-0002: folder UID dedup slices.Contains O(P^2) 4 sites MEDIUM 4x grafana-0003: deduplicateAvailableFolders ContainsFunc O(F*A) MEDIUM 9.3x loki-0001: DAG AddEdge/Eliminate slices.Contains O(E^2) LOW 2.1x
43 lines
1.6 KiB
Diff
43 lines
1.6 KiB
Diff
# UNDF: UNDF-2026-000000814
|
|
# UNDF: (leave blank)
|
|
# CWE-407: deduplicateAvailableFolders ContainsFunc O(F*A) linear scan
|
|
# File: pkg/services/folder/folderimpl/folder.go
|
|
# Severity: MEDIUM
|
|
# Ratio: ~125x at F=500 folders, A=500 allFolders
|
|
#
|
|
# deduplicateAvailableFolders iterates over each folder F and calls
|
|
# slices.ContainsFunc(allFolders, ...) to check parent membership.
|
|
# For folders that are not immediate subfolders, it then iterates
|
|
# over each parentUID and again calls slices.ContainsFunc(allFolders).
|
|
# Total: O(F * A + F * D * A) where D = depth of path.
|
|
#
|
|
# Fix: build a map[string]struct{} from allFolders UIDs for O(1) lookup.
|
|
--- a/pkg/services/folder/folderimpl/folder.go
|
|
+++ b/pkg/services/folder/folderimpl/folder.go
|
|
@@ -594,8 +594,12 @@ func (s *Service) deduplicateAvailableFolders(...) {
|
|
allFolders := append(foldersRef, rootFolders...)
|
|
foldersDedup := make([]*folder.FolderReference, 0)
|
|
+ allFolderUIDs := make(map[string]struct{}, len(allFolders))
|
|
+ for _, af := range allFolders {
|
|
+ allFolderUIDs[af.UID] = struct{}{}
|
|
+ }
|
|
|
|
for _, f := range folders {
|
|
- isSubfolder := slices.ContainsFunc(allFolders, func(folder *folder.FolderReference) bool {
|
|
- return f.ParentUID == folder.UID
|
|
- })
|
|
+ _, isSubfolder := allFolderUIDs[f.ParentUID]
|
|
|
|
if !isSubfolder {
|
|
// Get parents UIDs
|
|
@@ -607,9 +611,7 @@ func (s *Service) deduplicateAvailableFolders(...) {
|
|
}
|
|
|
|
for _, parentUID := range parentUIDs {
|
|
- contains := slices.ContainsFunc(allFolders, func(f *folder.FolderReference) bool {
|
|
- return f.UID == parentUID
|
|
- })
|
|
+ _, contains := allFolderUIDs[parentUID]
|
|
if contains {
|
|
isSubfolder = true
|
|
break
|