java-topology/whitepaper/outreach/thunderbird-0007.md

Thunderbird — CWE-407 Disclosure Brief (thunderbird-0007)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Thunderbird's folder pane initialization. Array.includes() on a fully-rebuilt array fires inside a do-while loop over folder URIs, producing O(F²) during IMAP server folder tree construction. Patched.

The Defects

thunderbird-0007 (PATCHED — MEDIUM-HIGH): mail/base/content/about3Pane.js

// In SmartServerPane.initServer() — fires on server pane initialization:
let existingURIs = Array.from(existingRows, li => li.uri);
do {
    const folderURI = remainingFolderURIs.shift();
    if (existingURIs.includes(folderURI)) {  // O(F) linear scan
        continue;
    }
    this.addFolder(...);
    // Array rebuilt from DOM on every iteration:
    existingURIs = Array.from(existingRows, li => li.uri);
} while (remainingFolderURIs.length);

After each addFolder() call, the entire existingURIs array is rebuilt from the live DOM NodeList via Array.from(). Every includes() call is O(F) and there are F iterations, producing O(F²) total. The DOM re-scan adds further O(F) overhead per iteration.

Complexity Proof

thunderbird-0007: At F=500 IMAP folders:

• Defective: ~125,000 includes comparisons + 500 full DOM scans
• Fixed: ~500 Set lookups + 500 Set.add() calls
• ~250× op reduction at F=500.

Impact

Fires during folder pane initialization for IMAP servers. Users with 500+ IMAP folders (common in enterprise environments) experience quadratic slowdown when the folder tree loads. The DOM re-scan on every iteration compounds the cost.

The Fix

thunderbird-0007: Use a Set<string> for existingURIs, updated incrementally:

// Before — O(F²)
let existingURIs = Array.from(existingRows, li => li.uri);
if (existingURIs.includes(folderURI)) { ... }
existingURIs = Array.from(existingRows, li => li.uri);  // full rebuild

// After — O(F)
const existingURIs = new Set(Array.from(existingRows, li => li.uri));
if (existingURIs.has(folderURI)) { ... }
existingURIs.add(folderURI);  // incremental update

Patch

Fix available: defects/thunderbird-0007/patch/thunderbird-0007_about3Pane_initServer_existingURIs_ON2.patch

Single-file patch in mail/base/content/about3Pane.js.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a Bugzilla reference (bugzilla.mozilla.org).
2. Assess severity — fires on folder pane initialization for IMAP servers.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Thunderbird team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.