47 lines
2.4 KiB
Diff
47 lines
2.4 KiB
Diff
# UNDF: UNDF-2026-000000829
|
||
# UNDF:
|
||
# Defect: netty-0001
|
||
# Component: io.netty.handler.ssl.JdkBaseApplicationProtocolNegotiator
|
||
# Pattern: CWE-407 — List.contains() in ALPN protocol negotiation
|
||
# Severity: MEDIUM
|
||
# Complexity: O(S×P) per TLS handshake → O(S+P) with HashSet
|
||
# Description: NoFailProtocolSelector.select() iterates supportedProtocols
|
||
# (a Set) and calls protocols.contains(p) where 'protocols' is a
|
||
# List<String>. Each contains() is O(P). With S supported and P offered
|
||
# protocols, total is O(S×P). Similarly, NoFailProtocolSelectionListener
|
||
# .selected() calls supportedProtocols.contains(protocol) on a
|
||
# List<String>. Fix: convert the List parameter to a HashSet for O(1)
|
||
# lookup in the select() method.
|
||
--- a/handler/src/main/java/io/netty/handler/ssl/JdkBaseApplicationProtocolNegotiator.java
|
||
+++ b/handler/src/main/java/io/netty/handler/ssl/JdkBaseApplicationProtocolNegotiator.java
|
||
@@ -144,7 +144,8 @@
|
||
@Override
|
||
public String select(List<String> protocols) throws Exception {
|
||
+ Set<String> protocolSet = new HashSet<>(protocols);
|
||
for (String p : supportedProtocols) {
|
||
- if (protocols.contains(p)) {
|
||
+ if (protocolSet.contains(p)) {
|
||
engineWrapper.setNegotiatedApplicationProtocol(p);
|
||
return p;
|
||
}
|
||
@@ -171,12 +172,14 @@
|
||
private static class NoFailProtocolSelectionListener implements ProtocolSelectionListener {
|
||
private final JdkSslEngine engineWrapper;
|
||
- private final List<String> supportedProtocols;
|
||
+ private final Set<String> supportedProtocolSet;
|
||
|
||
- NoFailProtocolSelectionListener(JdkSslEngine engineWrapper, List<String> supportedProtocols) {
|
||
+ NoFailProtocolSelectionListener(JdkSslEngine engineWrapper, List<String> supportedProtocols) {
|
||
this.engineWrapper = engineWrapper;
|
||
- this.supportedProtocols = supportedProtocols;
|
||
+ this.supportedProtocolSet = new HashSet<>(supportedProtocols);
|
||
}
|
||
|
||
@@ -185,7 +188,7 @@
|
||
@Override
|
||
public void selected(String protocol) throws Exception {
|
||
- if (supportedProtocols.contains(protocol)) {
|
||
+ if (supportedProtocolSet.contains(protocol)) {
|
||
engineWrapper.setNegotiatedApplicationProtocol(protocol);
|
||
} else {
|
||
noSelectedMatchFound(protocol);
|