russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.7 KiB

Raw Blame History

Thunderbird — CWE-407 Disclosure Brief (thunderbird-0006)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(M×E) defect in Thunderbird's spam whitelist checking. Linear scans through the identity email list fire on every incoming message, performing both email matching and domain extraction per message. Patched.

The Defects

thunderbird-0006 (PATCHED — MEDIUM): mailnews/base/src/nsSpamSettings.cpp

// In CheckWhiteList() — fires per incoming message:
// Email matching — O(E) per message:
for (uint32_t i = 0; i < mEmails.Length(); ++i) {
    if (mEmails[i].Equals(authorEmailAddress, ...))

// Domain matching — O(E) per message (with string alloc per element):
for (uint32_t i = 0; i < mEmails.Length(); ++i) {
    int32_t atPos = mEmails[i].FindChar('@');
    identityDomain = Substring(mEmails[i], atPos + 1);
    if (identityDomain.Equals(domain, ...))

Called for EVERY incoming message. Two separate linear scans through mEmails per message. For M messages with E identity emails, total cost is O(M×E) with string allocations on every domain extraction.

Complexity Proof

thunderbird-0006: At E=100 identity emails per message:

Defective: 200 comparisons + 100 string allocations per message
Fixed: 2 hash lookups per message
100× overhead at E=100. Fires on every incoming message.

Impact

Enterprise users with many identities (shared mailboxes, aliases, mailing lists) experience linear overhead on every incoming message during folder sync. The string allocation for domain extraction compounds the cost beyond pure comparison overhead.

The Fix

thunderbird-0006: Pre-compute HashSets of normalized emails and domains:

// Before — O(E) per message
for (uint32_t i = 0; i < mEmails.Length(); ++i) { ... }

// After — O(1) per message
nsTHashSet<nsCString> mEmailSet;
nsTHashSet<nsCString> mDomainSet;
// Built at Initialize() time, then:
if (mEmailSet.Contains(ToLowerCase(authorEmailAddress))) return;
if (mDomainSet.Contains(ToLowerCase(authorDomain))) return;

Patch

Fix available: defects/thunderbird-0006/patch/thunderbird-0006_nsSpamSettings_CheckWhiteList_ON2.patch

Single-file patch in mailnews/base/src/nsSpamSettings.cpp.

What We Ask

A patch is ready for review.

Confirm receipt and assign a Bugzilla reference (bugzilla.mozilla.org).
Assess severity — fires on every incoming message for every account.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Thunderbird team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.7 KiB Raw Blame History Unescape Escape