28 lines
1.4 KiB
Diff
28 lines
1.4 KiB
Diff
# UNDF: UNDF-2026-000000305
|
|
--- a/synapse/server_notices/resource_limits_server_notices.py
|
|
+++ b/synapse/server_notices/resource_limits_server_notices.py
|
|
@@ -190,15 +190,15 @@ class ResourceLimitsServerNotices:
|
|
pass
|
|
|
|
- referenced_events: List[str] = []
|
|
+ referenced_event_ids: List[str] = []
|
|
if pinned_state_event is not None:
|
|
- referenced_events = list(pinned_state_event.content.get("pinned", []))
|
|
+ referenced_event_ids = list(pinned_state_event.content.get("pinned", []))
|
|
|
|
- events = await self._store.get_events(referenced_events)
|
|
+ events = await self._store.get_events(referenced_event_ids)
|
|
+ # CWE-407 fix: use a set for O(1) membership and discard instead of O(n) list.remove()
|
|
+ referenced_set: set = set(referenced_event_ids)
|
|
for event_id, event in events.items():
|
|
if event.type != EventTypes.Message:
|
|
continue
|
|
if event.content.get("msgtype") == ServerNoticeMsgType:
|
|
currently_blocked = True
|
|
# remove event in case we need to disable blocking later on.
|
|
- if event_id in referenced_events:
|
|
- referenced_events.remove(event.event_id)
|
|
+ referenced_set.discard(event.event_id)
|
|
|
|
- return currently_blocked, referenced_events
|
|
+ return currently_blocked, list(referenced_set)
|