131 lines
7 KiB
Diff
131 lines
7 KiB
Diff
# UNDF: UNDF-2026-000000296
|
||
From 0000002 Mon Sep 17 00:00:00 2001
|
||
Subject: [PATCH] CWE-407: spring-0003/0004 — fix O(n²) ArrayList.contains()
|
||
in AbstractApplicationEventMulticaster
|
||
|
||
spring-0003 (HIGH): retrieveApplicationListeners() builds allListeners as
|
||
ArrayList<ApplicationListener<?>>. Inside the O(L) listenerBeans loop it calls
|
||
allListeners.contains() twice (lines 279, 285). With P programmatic listeners
|
||
already in the list each lookup is O(P+i). Total: O(L × (P+L)) = O(n²).
|
||
This path is hit on every event dispatch cache-miss — including startup events
|
||
in large Spring Boot applications.
|
||
|
||
spring-0004 (MEDIUM): DefaultListenerRetriever.getApplicationListeners() has
|
||
the same pattern: ArrayList allListeners, loop over applicationListenerBeans,
|
||
allListeners.contains(listener) at line 512.
|
||
|
||
Fix for both: replace ArrayList with LinkedHashSet (insertion-ordered, O(1)
|
||
contains/add). Remove the now-redundant contains() guards — Set.add() is
|
||
idempotent. Convert to List<> only for the final sort step.
|
||
|
||
CWE: CWE-407 (Inefficient Algorithmic Complexity)
|
||
Severity: spring-0003 HIGH, spring-0004 MEDIUM
|
||
---
|
||
.../event/AbstractApplicationEventMulticaster.java | 42 +++++++++----------
|
||
1 file changed, 19 insertions(+), 23 deletions(-)
|
||
|
||
diff --git a/spring-context/src/main/java/org/springframework/context/event/AbstractApplicationEventMulticaster.java b/spring-context/src/main/java/org/springframework/context/event/AbstractApplicationEventMulticaster.java
|
||
index aaaaaaa..bbbbbbb 100644
|
||
--- a/spring-context/src/main/java/org/springframework/context/event/AbstractApplicationEventMulticaster.java
|
||
+++ b/spring-context/src/main/java/org/springframework/context/event/AbstractApplicationEventMulticaster.java
|
||
@@ -17,6 +17,7 @@ import java.util.ArrayList;
|
||
import java.util.Collection;
|
||
import java.util.LinkedHashSet;
|
||
+import java.util.LinkedHashSet;
|
||
import java.util.List;
|
||
import java.util.Map;
|
||
import java.util.Set;
|
||
|
||
@@ -233,8 +234,8 @@ public abstract class AbstractApplicationEventMulticaster
|
||
private Collection<ApplicationListener<?>> retrieveApplicationListeners(
|
||
ResolvableType eventType, @Nullable Class<?> sourceType, @Nullable CachedListenerRetriever retriever) {
|
||
|
||
- List<ApplicationListener<?>> allListeners = new ArrayList<>();
|
||
+ // Use LinkedHashSet: O(1) add/contains, insertion-ordered for stable dispatch order.
|
||
+ LinkedHashSet<ApplicationListener<?>> allListenerSet = new LinkedHashSet<>();
|
||
Set<ApplicationListener<?>> filteredListeners = (retriever != null ? new LinkedHashSet<>() : null);
|
||
Set<String> filteredListenerBeans = (retriever != null ? new LinkedHashSet<>() : null);
|
||
|
||
@@ -249,7 +250,7 @@ public abstract class AbstractApplicationEventMulticaster
|
||
if (supportsEvent(listener, eventType, sourceType)) {
|
||
if (retriever != null) {
|
||
filteredListeners.add(listener);
|
||
}
|
||
- allListeners.add(listener);
|
||
+ allListenerSet.add(listener);
|
||
}
|
||
}
|
||
|
||
@@ -267,18 +268,14 @@ public abstract class AbstractApplicationEventMulticaster
|
||
ApplicationListener<?> unwrappedListener =
|
||
(ApplicationListener<?>) AopProxyUtils.getSingletonTarget(listener);
|
||
if (listener != unwrappedListener) {
|
||
if (filteredListeners != null && filteredListeners.contains(unwrappedListener)) {
|
||
filteredListeners.remove(unwrappedListener);
|
||
filteredListeners.add(listener);
|
||
}
|
||
- if (allListeners.contains(unwrappedListener)) {
|
||
- allListeners.remove(unwrappedListener);
|
||
- allListeners.add(listener);
|
||
- }
|
||
+ // O(1) remove+add on LinkedHashSet — replaces O(n) ArrayList scan
|
||
+ if (allListenerSet.remove(unwrappedListener)) {
|
||
+ allListenerSet.add(listener);
|
||
+ }
|
||
}
|
||
|
||
- if (!allListeners.contains(listener) && supportsEvent(listener, eventType, sourceType)) {
|
||
+ if (!allListenerSet.contains(listener) && supportsEvent(listener, eventType, sourceType)) {
|
||
if (retriever != null) {
|
||
if (beanFactory.isSingleton(listenerBeanName)) {
|
||
filteredListeners.add(listener);
|
||
@@ -287,7 +284,7 @@ public abstract class AbstractApplicationEventMulticaster
|
||
filteredListenerBeans.add(listenerBeanName);
|
||
}
|
||
}
|
||
- allListeners.add(listener);
|
||
+ allListenerSet.add(listener);
|
||
}
|
||
}
|
||
else {
|
||
@@ -295,7 +292,7 @@ public abstract class AbstractApplicationEventMulticaster
|
||
if (retriever != null) {
|
||
filteredListeners.remove(listener);
|
||
}
|
||
- allListeners.remove(listener);
|
||
+ allListenerSet.remove(listener);
|
||
}
|
||
}
|
||
}
|
||
|
||
+ List<ApplicationListener<?>> allListeners = new ArrayList<>(allListenerSet);
|
||
AnnotationAwareOrderComparator.sort(allListeners);
|
||
if (retriever != null) {
|
||
if (CollectionUtils.isEmpty(filteredListenerBeans)) {
|
||
|
||
@@ -502,14 +499,13 @@ public abstract class AbstractApplicationEventMulticaster
|
||
public Collection<ApplicationListener<?>> getApplicationListeners() {
|
||
- List<ApplicationListener<?>> allListeners = new ArrayList<>(
|
||
- this.applicationListeners.size() + this.applicationListenerBeans.size());
|
||
- allListeners.addAll(this.applicationListeners);
|
||
+ // LinkedHashSet: O(1) add() deduplicates programmatic + bean-name listeners
|
||
+ LinkedHashSet<ApplicationListener<?>> allListenerSet = new LinkedHashSet<>(this.applicationListeners);
|
||
if (!this.applicationListenerBeans.isEmpty()) {
|
||
BeanFactory beanFactory = getBeanFactory();
|
||
for (String listenerBeanName : this.applicationListenerBeans) {
|
||
try {
|
||
ApplicationListener<?> listener =
|
||
beanFactory.getBean(listenerBeanName, ApplicationListener.class);
|
||
- if (!allListeners.contains(listener)) { // O(n) scan — eliminated
|
||
- allListeners.add(listener);
|
||
- }
|
||
+ allListenerSet.add(listener); // O(1) — Set.add() is idempotent
|
||
}
|
||
catch (NoSuchBeanDefinitionException ex) {
|
||
}
|
||
}
|
||
}
|
||
+ List<ApplicationListener<?>> allListeners = new ArrayList<>(allListenerSet);
|
||
AnnotationAwareOrderComparator.sort(allListeners);
|
||
return allListeners;
|
||
}
|