russell@unturf.com
5f0585ef76
All 4 squid defects confirmed: squid-0001 CWE-407 NotePairs::appendNewOnly hasPair O(S*D) 374x; squid-0002 CWE-407 removeConnectionHeaderEntries strListIsMember O(H*C) 3x; squid-0003 CWE-312 FTP+Basic auth passwords logged verbatim incl DBG_IMPORTANT; squid-0004 CWE-407 whichPeer() O(P*A) ICP peer map 83x. MOAD-0002 SquidConfig god-object documented (structural). MOAD-0003/0005 CLEAN. All 4 unit tests PASS.
1.5 KiB
squid-0001 — CWE-407 O(S*D) NotePairs::appendNewOnly hasPair() linear scan
Target: Squid (squid-cache/squid, depth=1, 2026-03-31)
File: src/Notes.cc
Function: NotePairs::appendNewOnly(const NotePairs *src)
UNDF: UNDF-2026-000000870
Severity: MEDIUM
MOAD: 0001
Benchmark: 374.8x op-count reduction at S=D=500
Defect
NotePairs::appendNewOnly() merges annotations from one NotePairs object into
another, skipping duplicates. For each source entry it calls hasPair(), which
linearly scans all existing destination entries:
void
NotePairs::appendNewOnly(const NotePairs *src)
{
for (const auto &e: src->entries) {
if (!hasPair(e->name(), e->value())) // O(D) scan per source entry
entries.push_back(...);
}
}
Total complexity: O(S * D) where S = source entries, D = destination entries.
Called per HTTP request in ClientHttpRequest::initRequest() to merge connection
annotations into request annotations. At S=D=500 the defect performs 374,750 ops
vs 1,000 for our fix.
Fix
Build a std::set<std::pair<SBuf, SBuf>> of existing (name, value) pairs before
the loop, reducing hasPair() from O(D) to O(log D). Total: O((S+D) log D)
instead of O(S * D). The set is also updated as new entries are added so that
duplicate-within-src entries are also caught correctly.
Test
test/SquidNotePairsTest.java — pure Java simulation, no Squid install needed.
374.8x op-count ratio confirmed at S=D=500.