java-topology/defects/istio/patch/istio-0001-gateway-address-dedup-on2.patch
russell@unturf.com 05e6aace95 istio/argo-cd: CWE-407 findings
istio-0001: gateway reportGatewayStatus addressesToReport dedup O(I^2)
  pilot/pkg/config/kube/gateway/conversion.go +
  pilot/pkg/config/kube/agentgateway/gateway_status.go
  Fix: map[string]struct{} seen-set replaces slices.Contains on growing list

argo-cd-0001: mergeIgnoreDifferences O(P^2) per field type
  util/argo/diff/ignore.go
  Fix: pre-compute sets for JQPathExpressions/JSONPointers/ManagedFieldsManagers

Both: 2/2 unit tests PASS; 3.4x and 3.7x speedup measured
2026-03-30 09:53:12 -04:00

54 lines
2 KiB
Diff

# UNDF: UNDF-2026-000000114
# UNDF: (leave blank)
--- a/pilot/pkg/config/kube/gateway/conversion.go
+++ b/pilot/pkg/config/kube/gateway/conversion.go
@@ -1783,10 +1783,16 @@ func reportGatewayStatus(
if wantAddressType != k8s.HostnameAddressType {
addressesToReport = internalIP
}
if wantAddressType != k8s.IPAddressType {
+ pendingSet := make(map[string]struct{}, len(pending))
+ for _, p := range pending {
+ pendingSet[p] = struct{}{}
+ }
+ seenHosts := make(map[string]struct{}, len(internalIP))
+ for _, h := range addressesToReport {
+ seenHosts[h] = struct{}{}
+ }
for _, hostport := range internal {
svchost, _, _ := net.SplitHostPort(hostport)
- if !slices.Contains(pending, svchost) && !slices.Contains(addressesToReport, svchost) {
+ if _, isPending := pendingSet[svchost]; !isPending {
+ if _, isSeen := seenHosts[svchost]; !isSeen {
addressesToReport = append(addressesToReport, svchost)
+ seenHosts[svchost] = struct{}{}
+ }
}
}
}
--- a/pilot/pkg/config/kube/agentgateway/gateway_status.go
+++ b/pilot/pkg/config/kube/agentgateway/gateway_status.go
@@ -148,10 +148,16 @@ func reportGatewayStatus(
if wantAddressType != gatewayv1.HostnameAddressType {
addressesToReport = internalIP
}
if wantAddressType != gatewayv1.IPAddressType {
+ pendingSet := make(map[string]struct{}, len(pending))
+ for _, p := range pending {
+ pendingSet[p] = struct{}{}
+ }
+ seenHosts := make(map[string]struct{}, len(internalIP))
+ for _, h := range addressesToReport {
+ seenHosts[h] = struct{}{}
+ }
for _, hostport := range internal {
svchost, _, _ := net.SplitHostPort(hostport)
- if !slices.Contains(pending, svchost) && !slices.Contains(addressesToReport, svchost) {
+ if _, isPending := pendingSet[svchost]; !isPending {
+ if _, isSeen := seenHosts[svchost]; !isSeen {
addressesToReport = append(addressesToReport, svchost)
+ seenHosts[svchost] = struct{}{}
+ }
}
}
}