UNDF: UNDF-2026-000000478

nomad-0003: GetVaultConfigurations secrets dedup — O(tasks × secrets²)

CWE

CWE-407: Inefficient Algorithmic Complexity

Severity

MEDIUM

Location

nomad/structs/structs.go:5098-5102

Description

Three nested loops — task groups → tasks → secrets — with an inner slices.Contains(secrets, s.Provider) scan to deduplicate providers. The secrets slice grows as providers are appended, so each check scans an O(P) growing accumulator.

for _, tg := range j.TaskGroups {
    secrets := []string{}
    for _, task := range tg.Tasks {
        for _, s := range task.Secrets {
            if !slices.Contains(secrets, s.Provider) {   // O(|secrets|)
                secrets = append(secrets, s.Provider)
            }
        }
    }
}

Fix

Replace secrets []string accumulator with map[string]struct{}.

Speedup

~Px where P = number of distinct secret providers per task group.

950 B Raw Permalink Blame History Unescape Escape