russell@unturf.com
14c3a92bab
taiga-0001: taiga/events/middleware.py stores request X-Session-ID in threading.local, leaking it across thread-pool requests when process_response is skipped. Fix: replace with contextvars.ContextVar for proper per-request isolation. redmine-0004: Role#add_permission! in app/models/role.rb calls permissions.include?(p) (Array O(P)) inside a perms.each loop — O(P^2) total. At P=1000 permissions, 68.6x overhead measured. Fix: build a Set once before the loop, use Set#add?.
3 lines
167 B
Text
3 lines
167 B
Text
MOAD-0004 (CWE-312): CLEAN
|
|
No passwords, tokens, or LDAP credentials logged verbatim in error paths.
|
|
Auth logging limited to error messages without credential values.
|