java-topology/whitepaper/outreach/ofbiz-0002.md

Apache OFBiz — CWE-407 Disclosure Brief (ofbiz-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Two O(N²) defects in Apache OFBiz's order return processing. Patched. OrderReturnServices and OrderReadHelper use LinkedList.contains() for dedup when processing return items and payment records.

The Defects

ofbiz-0002 (PATCHED — MEDIUM):

1. OrderReturnServices.java:2352 — Payment dedup during return processing:

List<String> paymentList = new LinkedList<>();
// ...
if (!paymentList.contains(payment.get("paymentId"))) {  // O(N) scan
    paymentList.add(payment.getString("paymentId"));
}

2. OrderReadHelper.java:2235 — Return header dedup:

List<String> returnHeaderList = new LinkedList<>();
// ...
if (!returnHeaderList.contains(returnedItem.getString("returnId"))) {  // O(N)
    returnHeaderList.add(returnedItem.getString("returnId"));
}

Both use LinkedList<String>.contains() which is O(N) per check.

Complexity Proof

At P=500 payments / R=500 return headers:

• Defective: 500 × 250 avg = 125,000 string comparisons each
• Fixed: 500 × O(1) = 500 operations each
• 250× op reduction per dedup loop.

Impact

Apache OFBiz is an open-source ERP/CRM platform. Return processing fires when calculating return amounts and listing return headers. High-volume e-commerce with many returns and payments triggers quadratic dedup.

The Fix

Replace LinkedList<String> with HashSet<String> / LinkedHashSet<String>:

// Before
List<String> paymentList = new LinkedList<>();

// After
Set<String> paymentSet = new HashSet<>();
Set<String> returnHeaderSet = new LinkedHashSet<>();  // preserves iteration order

Patch

Fix available: defects/ofbiz-0002/patch/ofbiz-0002-order-return-list-dedup.patch

Touches OrderReturnServices.java and OrderReadHelper.java. 250× speedup at 500 entries.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a Jira issue reference (Apache OFBiz).
2. Assess severity — fires during order return processing.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Apache OFBiz team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.