java-topology/defects/pulsar/patch/pulsar-0002-persistent-topic-replication-cluster-list-contains.patch
russell@unturf.com b0a9a83efc pulsar: 3 CWE-407 defects — load-manager/replicator/namespace List.contains O(N^2)
pulsar-0001: ModularLoadManagerImpl.reapDeadBrokerPreallocations() receives
  aliveBrokers as List<String> from listLocks(); .contains() inside O(B) loop
  → O(B^2); fix: HashSet wrap before loop.
pulsar-0002: PersistentTopic.removeOrphanReplicationCursors() and
  checkReplicationStatus() call configuredClusters.contains() (List<String>)
  inside loops over cursors and replicators → O(C×R); fix: HashSet wrap.
pulsar-0003: NamespacesBase.internalGetTopicHashPositionsAsync() calls
  allTopicsInThisBundle.contains() (List<String>) inside for loop over query
  topics → O(T×B); fix: HashSet wrap before loop.

UNDF-2026-000000505 through UNDF-2026-000000507; 3/3 unit tests PASS.
2026-03-30 08:43:51 -04:00

27 lines
1.7 KiB
Diff

# UNDF: UNDF-2026-000000506
# UNDF:
--- a/pulsar-broker/src/main/java/org/apache/pulsar/broker/service/persistent/PersistentTopic.java
+++ b/pulsar-broker/src/main/java/org/apache/pulsar/broker/service/persistent/PersistentTopic.java
@@ -547,9 +547,9 @@ public class PersistentTopic extends AbstractTopic implements Topic, AddEntryCal
private CompletableFuture<Void> removeOrphanReplicationCursors() {
List<CompletableFuture<Void>> futures = new ArrayList<>();
- List<String> replicationClusters = topicPolicies.getReplicationClusters().get();
+ Set<String> replicationClusters = new HashSet<>(topicPolicies.getReplicationClusters().get());
for (ManagedCursor cursor : ledger.getCursors()) {
if (cursor.getName().startsWith(replicatorPrefix)) {
String remoteCluster = PersistentReplicator.getRemoteCluster(cursor.getName());
if (!replicationClusters.contains(remoteCluster)) {
log.warn("Remove the orphan replicator because the cluster '{}' does not exist", remoteCluster);
futures.add(removeReplicator(remoteCluster));
}
}
}
return FutureUtil.waitForAll(futures);
}
@@ -1954,7 +1954,7 @@ public class PersistentTopic extends AbstractTopic implements Topic, AddEntryCal
- List<String> configuredClusters = topicPolicies.getReplicationClusters().get();
+ Set<String> configuredClusters = new HashSet<>(topicPolicies.getReplicationClusters().get());
if (CollectionUtils.isEmpty(configuredClusters)) {
log.warn("[{}] No replication clusters configured", name);
return CompletableFuture.completedFuture(null);