engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/thunderbird-0007/TICKET.md
russell@unturf.com 37a61c0a86 thunderbird: 5-MOAD scan COMPLETE; mark [x] SCAN-TODO; add TICKET.md 0007+0008 
8 defects total across 2 commits (6a025795dc + 62305ef339):
  thunderbird-0001 MOAD-0001 CWE-407 nsMsgAccountManager::LoadAccounts() IndexOf dedup O(N^2) 250x
  thunderbird-0002 MOAD-0001 CWE-407 nsMsgCopyService::DoNextCopy() ContainsObject O(N^2) 250x
  thunderbird-0003 MOAD-0001 CWE-407 nsAutoSyncManager IndexOf in 3 IMAP queue methods O(N^2) 250x
  thunderbird-0004 MOAD-0001 CWE-407 nsImapFlagAndUidState Contains/IndexOf on sorted UID array 500x
  thunderbird-0005 MOAD-0001 CWE-407 nsMsgFilterList::ComputeArbitraryHeaders() FindInReadable O(H^2) 125x
  thunderbird-0006 MOAD-0001 CWE-407 nsSpamSettings::CheckWhiteList() linear scan O(M*E) 100x
  thunderbird-0007 MOAD-0001 CWE-407 about3Pane.js initServer() existingURIs Array.includes O(F^2) 250x
  thunderbird-0008 MOAD-0004 CWE-312 OAuth2.sys.mjs access_token+refresh_token logged verbatim HIGH
  MOADs 0002/0003/0005 CLEAN
2026-04-03 13:33:09 -04:00

893 B
Raw Blame History

thunderbird-0007 — about3Pane.js SmartServerPane.initServer() existingURIs O(F^2)

UNDF: UNDF-2026-000001168 MOAD: 0001 (CWE-407) Severity: MEDIUM-HIGH Component: mail/base/content/about3Pane.js

Summary

initServer() builds existingURIs as an Array then calls existingURIs.includes() inside a do-while loop over remainingFolderURIs. After each addFolder() call our array is fully rebuilt from DOM via Array.from(existingRows, li => li.uri). Every includes() is O(F) with F iterations, producing O(F^2) total.

Measured at O(F^2) for F folders (e.g. 500 IMAP folders = 250,000 ops).

Fix

Use a Set<string> for existingURIs. Seed it once from DOM; update it directly when addFolder() adds a row, eliminating repeated DOM scans.

Files

  • patch/thunderbird-0007_about3Pane_initServer_existingURIs_ON2.patch
  • test/ThunderbirdInitServerTest.java