java-topology/defects/rocketchat/patch/0003.patch
russell@unturf.com 60b0999acd wekan+rocketchat: 3 defects, all 5 MOADs scanned
wekan-0003: MOAD-0001 wekanCreator.js member dedup uses Array.some()/find()
  inside forEach inside for-of, O(M^2) for board members and O(C*M^2) for
  card members/assignees during board import. Fix: Set-based dedup O(1).
  58.8x op-count reduction (board), 5.6x (cards). 4/4 PASS.

rocketchat-0003: MOAD-0001 endDirectCall() calls call.users.find() inside
  for (subscription of subscriptions), O(S*U) where S=room members and
  U=already-joined users. Fix: build Set before loop for O(1) lookup.
  100x speedup modeled at S=10000, J=100. 5/5 PASS.

rocketchat-0004: MOAD-0004 CWE-312 oauth2-server/model.ts logs clientSecret,
  accessToken, refreshToken, and authorizationCode verbatim via console.log
  when debug=true. Fix: replace credential values with [REDACTED] sentinel.

Wekan MOAD-0002/0003/0004/0005 CLEAN (Meteor 3.4, AsyncLocalStorage, no
god-object coupling, no credential logging found, no concurrent cache race).
Rocket.Chat MOAD-0002/0003/0005 CLEAN (Meteor 3.3.2, AsyncLocalStorage,
clientVersionsStore single-writer, service boundaries intact).
2026-03-31 20:50:31 -04:00

27 lines
1.2 KiB
Diff

--- a/apps/meteor/server/services/video-conference/service.ts
+++ b/apps/meteor/server/services/video-conference/service.ts
@@ -529,12 +529,14 @@ export class VideoConferenceService extends ServiceClassInternal implements IVid
private async endDirectCall(call: IDirectVideoConference): Promise<void> {
const params = { rid: call.rid, uid: call.createdBy._id, callId: call._id };
// Notify the caller that the call was ended by the server
this.notifyUser(call.createdBy._id, 'end', params);
// If the callee hasn't joined the call yet, notify them that it has already ended
const subscriptions = await Subscriptions.findByRoomIdAndNotUserId(call.rid, call.createdBy._id, {
projection: { 'u._id': 1, '_id': 0 },
}).toArray();
+ // Build a Set so the joined-user lookup is O(1) per subscription
+ // instead of O(U) per subscription (O(S*U) overall) via Array.find().
+ const joinedUserIds = new Set(call.users.map(({ _id }) => _id));
for (const subscription of subscriptions) {
// Skip notifying users that already joined the call
- if (call.users.find(({ _id }) => _id === subscription.u._id)) {
+ if (joinedUserIds.has(subscription.u._id)) {
continue;
}
this.notifyUser(subscription.u._id, 'end', params);
}
}