22 lines
930 B
Diff
22 lines
930 B
Diff
# UNDF: UNDF-2026-000000859
|
|
--- a/src/api/server_server.rs
|
|
+++ b/src/api/server_server.rs
|
|
@@ -1254,6 +1254,9 @@ pub async fn get_missing_events_route(
|
|
|
|
let mut queued_events = body.latest_events.clone();
|
|
let mut events = Vec::new();
|
|
+ // CWE-407 fix: convert earliest_events to HashSet for O(1) membership test.
|
|
+ // Old code: Vec::contains() is O(E) per check inside a growing BFS loop,
|
|
+ // yielding O(Q*E) total. New code: O(Q) total via HashSet.
|
|
+ let earliest_set: HashSet<_> = body.earliest_events.iter().cloned().collect();
|
|
|
|
let mut i = 0;
|
|
while i < queued_events.len() && events.len() < u64::from(body.limit) as usize {
|
|
@@ -1281,7 +1284,7 @@ pub async fn get_missing_events_route(
|
|
}
|
|
|
|
- if body.earliest_events.contains(&queued_events[i]) {
|
|
+ if earliest_set.contains(&queued_events[i]) {
|
|
i += 1;
|
|
continue;
|
|
}
|