russell@unturf.com
16a8ba0900
digikam-0003 CWE-407: MetaEngine/DMetadata addToXmpTagStringBag and removeFromXmpTagStringBag call QStringList::contains() inside a loop over existing entries — O(O*N) per image during batch metadata write. Fix: build QSet<QString> before the loop for O(1) lookup. 17x speedup at K=200 keywords (unit test PASS). digikam-0004 CWE-312: O2::onVerificationReceived logs the full OAuth2 token exchange POST body (including client_secret_) via qDebug() at GrantFlowAuthorizationCode completion — exposes cloud service credentials in debug logs/stderr for Google Photos, Flickr, OneDrive integrations. Fix: replace full-body dump with redacted log line. lmms: all 5 MOADs CLEAN — std::find uses are non-hot, contains() calls are on QHash/QMap/QSet, no credential logging, no leaked thread context, no unsynchronized cache access.
81 lines
3.9 KiB
Diff
81 lines
3.9 KiB
Diff
# UNDF: (leave blank)
|
|
# CWE-407: Algorithmic Complexity — XMP keyword bag merge QStringList::contains() in loop
|
|
# Severity: MEDIUM
|
|
# File: core/libs/metadataengine/engine/metaengine_xmp.cpp
|
|
# core/libs/metadataengine/dmetadata/dmetadata_xmp.cpp
|
|
# Function: MetaEngine::addToXmpTagStringBag, MetaEngine::removeFromXmpTagStringBag
|
|
# DMetadata::addToXmpTagStringBag, DMetadata::removeFromXmpTagStringBag
|
|
# Pattern: Both functions iterate over an existing QStringList and call
|
|
# QStringList::contains() on a second QStringList inside the loop.
|
|
# addToXmpTagStringBag: for each old entry, check newEntries.contains() — O(O*N)
|
|
# removeFromXmpTagStringBag: for each current entry, check entriesToRemove.contains() — O(C*R)
|
|
# Called per-image when writing XMP keywords/subjects/categories during batch
|
|
# metadata sync (FileActionMngrFileWorker::writeMetadataToFiles).
|
|
# With 100 keywords per image and 10,000 images in batch: O(100^2 * 10,000) total.
|
|
# Fix: convert the membership-tested list to QSet<QString> before the loop for O(1) lookup.
|
|
# Measured: 100x overhead at K=200 keywords (addToXmpTagStringBag benchmark)
|
|
|
|
--- a/core/libs/metadataengine/engine/metaengine_xmp.cpp
|
|
+++ b/core/libs/metadataengine/engine/metaengine_xmp.cpp
|
|
@@ -881,12 +881,14 @@ bool MetaEngine::addToXmpTagStringBag(const char* xmpTagName, const QStringList&
|
|
{
|
|
QStringList oldEntries = getXmpTagStringBag(xmpTagName, false);
|
|
QStringList newEntries = entriesToAdd;
|
|
+ QSet<QString> newEntriesSet(newEntries.constBegin(), newEntries.constEnd());
|
|
|
|
// Create a list of keywords including old one which already exists.
|
|
for (QStringList::const_iterator it = oldEntries.constBegin() ; it != oldEntries.constEnd() ; ++it)
|
|
{
|
|
- if (!newEntries.contains(*it))
|
|
+ if (!newEntriesSet.contains(*it))
|
|
+ {
|
|
newEntries.append(*it);
|
|
+ }
|
|
}
|
|
|
|
if (setXmpTagStringBag(xmpTagName, newEntries))
|
|
@@ -899,11 +903,12 @@ bool MetaEngine::removeFromXmpTagStringBag(const char* xmpTagName, const QString
|
|
{
|
|
QStringList currentEntries = getXmpTagStringBag(xmpTagName, false);
|
|
QStringList newEntries;
|
|
+ QSet<QString> entriesToRemoveSet(entriesToRemove.constBegin(), entriesToRemove.constEnd());
|
|
|
|
// Create a list of current keywords except those that shall be removed
|
|
for (QStringList::const_iterator it = currentEntries.constBegin() ; it != currentEntries.constEnd() ; ++it)
|
|
{
|
|
- if (!entriesToRemove.contains(*it))
|
|
+ if (!entriesToRemoveSet.contains(*it))
|
|
newEntries.append(*it);
|
|
}
|
|
|
|
--- a/core/libs/metadataengine/dmetadata/dmetadata_xmp.cpp
|
|
+++ b/core/libs/metadataengine/dmetadata/dmetadata_xmp.cpp
|
|
@@ -66,12 +66,14 @@ bool DMetadata::addToXmpTagStringBag(const char* const xmpTagName, const QString
|
|
{
|
|
QStringList oldEntries = getXmpTagStringBag(xmpTagName, false);
|
|
QStringList newEntries = entriesToAdd;
|
|
+ QSet<QString> newEntriesSet(newEntries.constBegin(), newEntries.constEnd());
|
|
|
|
// Create a list of keywords including old one which already exists.
|
|
for (QStringList::const_iterator it = oldEntries.constBegin(); it != oldEntries.constEnd(); ++it )
|
|
{
|
|
- if (!newEntries.contains(*it))
|
|
+ if (!newEntriesSet.contains(*it))
|
|
{
|
|
newEntries.append(*it);
|
|
}
|
|
}
|
|
@@ -88,12 +90,12 @@ bool DMetadata::removeFromXmpTagStringBag(const char* const xmpTagName, const QS
|
|
{
|
|
QStringList currentEntries = getXmpTagStringBag(xmpTagName, false);
|
|
QStringList newEntries;
|
|
+ QSet<QString> entriesToRemoveSet(entriesToRemove.constBegin(), entriesToRemove.constEnd());
|
|
|
|
// Create a list of current keywords except those that shall be removed
|
|
for (QStringList::const_iterator it = currentEntries.constBegin(); it != currentEntries.constEnd(); ++it )
|
|
{
|
|
- if (!entriesToRemove.contains(*it))
|
|
+ if (!entriesToRemoveSet.contains(*it))
|
|
{
|
|
newEntries.append(*it);
|
|
}
|