russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.5 KiB

Raw Blame History

Jitsi Meet — CWE-407 Disclosure Brief (jitsi-meet-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Jitsi Meet's chat message container. The MessageContainer component uses Array.includes() to detect new messages by checking each current message against the entire previous message list, producing O(M²) per re-render.

The Defect

jitsi-meet-0002 (PATCHED — MEDIUM): react/features/chat/components/web/MessageContainer.tsx:176

componentDidUpdate(prevProps: IProps) {
    const newMessages = this.props.messages.filter(
        message => !prevProps.messages.includes(message)  // O(M) per message
    );
    const hasLocalMessage = newMessages.map(
        message => message.messageType
    ).includes(MESSAGE_TYPE_LOCAL);  // O(N) on intermediate array
}

prevProps.messages.includes(message) is O(M) per message, and filter() runs for all current messages, giving O(M²) total. Additionally, the chained .map().includes() creates an intermediate array unnecessarily.

Complexity Proof

At M=500 messages:

Defective: 500 × 500 = 250,000 reference comparisons per update
Fixed: 500 Set lookups + .some() short-circuit = ~500 operations
~500× op reduction.

Impact

Jitsi Meet is one of the most widely deployed open-source video conferencing platforms. The chat message container re-renders on every new message. In long meetings with active chat, the message list grows and every new message triggers a quadratic diff.

The Fix

Build a Set from previous messages, and use .some() instead of .map().includes():

const prevSet = new Set(prevProps.messages);
const newMessages = this.props.messages.filter(message => !prevSet.has(message));
const hasLocalMessage = newMessages.some(
    message => message.messageType === MESSAGE_TYPE_LOCAL
);

Patch

Fix available: defects/jitsi-meet-0002/patch/jitsi-meet-0002-message-dedup.patch

Single-file patch in MessageContainer.tsx. ~500× speedup at 500 messages.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (jitsi/jitsi-meet).
Assess severity — fires on every chat message render in active conferences.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Jitsi team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Blame History Unescape Escape