russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Permalink Blame History

Forgejo — CWE-407 Disclosure Brief (forgejo-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(P*L) defect in Forgejo's license sorting during repository initialization. Patched. Patch ready for upstream review.

The Defects

forgejo-0002 (PATCHED — MEDIUM): modules/repository/init.go:104

// In LoadRepoConfig() — fires at server startup:
for _, name := range setting.Repository.PreferredLicenses {
    if util.SliceContainsString(Licenses, name, true) {  // O(L) scan
        sortedLicenses = append(sortedLicenses, name)
    }
}
for _, name := range Licenses {
    if !util.SliceContainsString(setting.Repository.PreferredLicenses, name, true) {  // O(P)
        sortedLicenses = append(sortedLicenses, name)
    }
}

Two nested scans: O(PL) for preferred-in-licenses check and O(LP) for licenses-not-preferred check. With P preferred licenses and L total licenses, combined cost reaches O(PL + LP) = O(2PL).

Complexity Proof

At P=20 preferred, L=400 licenses:

Defective: 20 x 400 + 400 x 20 = 16,000 comparisons
Fixed: 20 + 400 = 420 lookups (map)
~38x op reduction.

Impact

Forgejo loads and sorts licenses at server startup. The license list includes hundreds of SPDX identifiers. While startup-only, the fix demonstrates the pattern.

The Fix

Build map[string]struct{} sets for both lists:

// Before
util.SliceContainsString(Licenses, name, true)

// After
licensesSet[strings.ToLower(name)]

Patch

Fix available: defects/forgejo-0002/patch/forgejo-0002.patch

Single-file patch on modules/repository/init.go. 38x speedup at P=20, L=400.

What We Ask

A patch is ready for review.

Confirm receipt and assign a Forgejo issue reference (codeberg.org/forgejo/forgejo).
Assess severity — fires at server startup; scales with license catalog size.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Forgejo team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Permalink Blame History