79 lines
3 KiB
Diff
79 lines
3 KiB
Diff
# UNDF: UNDF-2026-000000163
|
|
diff --git a/impl/maven-core/src/main/java/org/apache/maven/internal/impl/Graph.java b/impl/maven-core/src/main/java/org/apache/maven/internal/impl/Graph.java
|
|
index 1f6cef3..dcfaeec 100644
|
|
--- a/impl/maven-core/src/main/java/org/apache/maven/internal/impl/Graph.java
|
|
+++ b/impl/maven-core/src/main/java/org/apache/maven/internal/impl/Graph.java
|
|
@@ -23,6 +23,7 @@
|
|
import java.util.Collections;
|
|
import java.util.HashMap;
|
|
import java.util.LinkedHashMap;
|
|
+import java.util.LinkedHashSet;
|
|
import java.util.LinkedList;
|
|
import java.util.List;
|
|
import java.util.Map;
|
|
@@ -110,8 +111,10 @@ private static List<String> visitCycle(
|
|
|
|
static class Vertex {
|
|
final String label;
|
|
- final List<Vertex> children = new ArrayList<>();
|
|
- final List<Vertex> parents = new ArrayList<>();
|
|
+ // CWE-407 fix: LinkedHashSet gives O(1) add/remove/contains vs O(n) ArrayList.
|
|
+ // Insertion order preserved for deterministic topological sort output.
|
|
+ final LinkedHashSet<Vertex> children = new LinkedHashSet<>();
|
|
+ final LinkedHashSet<Vertex> parents = new LinkedHashSet<>();
|
|
|
|
Vertex(String label) {
|
|
this.label = label;
|
|
@@ -121,11 +124,11 @@ String getLabel() {
|
|
return label;
|
|
}
|
|
|
|
- List<Vertex> getChildren() {
|
|
+ Collection<Vertex> getChildren() {
|
|
return children;
|
|
}
|
|
|
|
- List<Vertex> getParents() {
|
|
+ Collection<Vertex> getParents() {
|
|
return parents;
|
|
}
|
|
}
|
|
diff --git a/impl/maven-core/src/main/java/org/apache/maven/project/Graph.java b/impl/maven-core/src/main/java/org/apache/maven/project/Graph.java
|
|
index 6baae1e..d69655a 100644
|
|
--- a/impl/maven-core/src/main/java/org/apache/maven/project/Graph.java
|
|
+++ b/impl/maven-core/src/main/java/org/apache/maven/project/Graph.java
|
|
@@ -23,6 +23,7 @@
|
|
import java.util.Collections;
|
|
import java.util.HashMap;
|
|
import java.util.LinkedHashMap;
|
|
+import java.util.LinkedHashSet;
|
|
import java.util.LinkedList;
|
|
import java.util.List;
|
|
import java.util.Map;
|
|
@@ -110,8 +111,10 @@ private static List<String> visitCycle(
|
|
|
|
static class Vertex {
|
|
final String label;
|
|
- final List<Vertex> children = new ArrayList<>();
|
|
- final List<Vertex> parents = new ArrayList<>();
|
|
+ // CWE-407 fix: LinkedHashSet gives O(1) add/remove/contains vs O(n) ArrayList.
|
|
+ // Insertion order preserved for deterministic topological sort output.
|
|
+ final LinkedHashSet<Vertex> children = new LinkedHashSet<>();
|
|
+ final LinkedHashSet<Vertex> parents = new LinkedHashSet<>();
|
|
|
|
Vertex(String label) {
|
|
this.label = label;
|
|
@@ -121,11 +124,11 @@ String getLabel() {
|
|
return label;
|
|
}
|
|
|
|
- List<Vertex> getChildren() {
|
|
+ Collection<Vertex> getChildren() {
|
|
return children;
|
|
}
|
|
|
|
- List<Vertex> getParents() {
|
|
+ Collection<Vertex> getParents() {
|
|
return parents;
|
|
}
|
|
}
|