russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

1.8 KiB

Raw Permalink Blame History

Forgejo — CWE-407 Disclosure Brief (forgejo-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(R^2) defect in Forgejo's code search results repo-ID deduplication. Patched. Patch ready for upstream review.

The Defects

forgejo-0001 (PATCHED — MEDIUM): modules/indexer/code/search.go:50

// In RepoIDs() — fires on every code search:
for _, r := range res {
    if !slices.Contains(ids, r.RepoID) {  // O(N) linear scan
        ids = append(ids, r.RepoID)
    }
}

slices.Contains performs O(N) linear scan for each result. With R results, extracting unique repo IDs costs O(R^2).

Complexity Proof

At R=500 search results:

Defective: 500 x 500 / 2 = 125,000 comparisons
Fixed: 500 x 1 = 500 lookups (map)
250x op reduction.

Impact

Forgejo is a major community fork of Gitea. Code search returns results across many repositories. Large instances with thousands of repos and many search results pay quadratic dedup costs per search query.

The Fix

Use a map[int64]struct{} for O(1) dedup:

// Before
slices.Contains(ids, r.RepoID)

// After
seen := make(map[int64]struct{})
if _, ok := seen[r.RepoID]; !ok { seen[r.RepoID] = struct{}{}; ... }

Patch

Fix available: defects/forgejo-0001/patch/forgejo-0001.patch

Single-file patch on modules/indexer/code/search.go. 250x speedup at R=500 results.

What We Ask

A patch is ready for review.

Confirm receipt and assign a Forgejo issue reference (codeberg.org/forgejo/forgejo).
Assess severity — fires on every code search; scales with result count.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Forgejo team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

1.8 KiB Raw Permalink Blame History