russell@unturf.com be19bb7757 openshot+opentoonz: 3 CWE-407 defects, all 5 MOADs scanned

openshot-0001: QueryObject.filter(id=x) O(N) scan called in loop over
selected clips/transitions — O(S*C) total. Fix: build id->clip dict once.

libopenshot-0001: std::find(display_classes...) inside per-frame detection
loop in ObjectDetection.cpp — O(D*C) per frame. Fix: unordered_set.

opentoonz-0001: std::find(closingSegments...) inside endpoint loop in
autoclose.cpp spotResearchOnePoint() — O(E*C) per vectorization call, runs
per-frame during painted cell rendering. Fix: set-based dedup.

MOADs 2-5 CLEAN: no god-object coupling defects, no leaked thread context,
no credential logging (SVN password is CLI arg not logged), no thundering
herd in image/frame caches (all properly mutex-guarded).

3/3 unit tests PASS.

2026-03-31 21:21:27 -04:00

1.7 KiB

Raw Permalink Blame History

MOAD-0002 through 0005 scan: OpenShot-Qt + libopenshot

Target: OpenShot-Qt (Python video editor) + libopenshot (C++ library) Date: 2026-03-31

MOAD-0001 (CWE-407)

openshot-0001: QueryObject.filter(id=clip_id) O(N) linear scan inside loop over selected clips in main_window.py. O(S*C) total. DEFECT — patched.
libopenshot-0001: std::find(display_classes...) inside per-frame detection loop in ObjectDetection.cpp. O(D*C) per frame. DEFECT — patched (separate defect directory).

MOAD-0002 (Intertangle)

get_app() is a god object called 766 times across 130+ files. However, this is a Qt application pattern (single global application object) and not a defect in our sense: subsystems do not couple through it in ways that cause emergent failure or coupling to shared mutable render state. Preview thread, export thread, and update manager communicate through well-defined Qt signals. CLEAN for MOAD-0002.

MOAD-0003 (Leaked Context)

No threading.local found in our Python source for request-scoped identity. Our preview thread uses threading.Lock for seek queue safety (correct usage). libopenshot uses std::recursive_mutex throughout the cache. CLEAN for MOAD-0003.

MOAD-0004 (CWE-312)

Scanned export.py, generation_service.py, comfy_client.py for OAuth tokens, API keys, and upload credentials. No credentials logged verbatim. ComfyUI base URL is logged but not auth tokens. CLEAN for MOAD-0004.

MOAD-0005 (Thundering Herd)

libopenshot/src/CacheMemory.cpp uses std::recursive_mutex with std::lock_guard on every cache operation (Add, Contains, GetFrame, MoveToFront, Clear). No unguarded get+check+compute+put pattern. CLEAN for MOAD-0005.

1.7 KiB Raw Permalink Blame History