32 lines
1.3 KiB
Diff
32 lines
1.3 KiB
Diff
# UNDF: UNDF-2026-000000832
|
||
# UNDF:
|
||
# Defect: tomcat-0001
|
||
# Component: org.apache.tomcat.websocket.server.DefaultServerEndpointConfigurator
|
||
# Pattern: CWE-407 — List.contains() in getNegotiatedSubprotocol loop
|
||
# Severity: MEDIUM
|
||
# Complexity: O(R×S) per WebSocket upgrade → O(R+S) with HashSet
|
||
# Description: getNegotiatedSubprotocol iterates over 'requested' protocols
|
||
# and calls supported.contains(request) on a List<String>, making each
|
||
# contains() O(S). With R requested and S supported protocols, this is
|
||
# O(R×S). Fix: convert 'supported' to a HashSet for O(1) lookup.
|
||
--- a/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java
|
||
+++ b/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java
|
||
@@ -17,6 +17,7 @@
|
||
package org.apache.tomcat.websocket.server;
|
||
|
||
import java.util.ArrayList;
|
||
+import java.util.LinkedHashSet;
|
||
import java.util.HashSet;
|
||
import java.util.List;
|
||
import java.util.Set;
|
||
@@ -46,7 +47,8 @@
|
||
@Override
|
||
public String getNegotiatedSubprotocol(List<String> supported, List<String> requested) {
|
||
|
||
+ Set<String> supportedSet = new HashSet<>(supported);
|
||
for (String request : requested) {
|
||
- if (supported.contains(request)) {
|
||
+ if (supportedSet.contains(request)) {
|
||
return request;
|
||
}
|
||
}
|