russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.6 KiB

Raw Blame History

Grafana Loki — CWE-407 Disclosure Brief (loki-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(E²) defect in Grafana Loki's query planner DAG. The Graph.AddEdge() and Graph.Eliminate() methods use slices.Contains() on adjacency slices for edge uniqueness checking, producing O(E²) total cost for bulk edge insertion where E = edges per node.

The Defect

loki-0001 (PATCHED — LOW): pkg/engine/internal/util/dag/dag.go:95

// AddEdge — uniqueness check via linear scan:
if !slices.Contains(g.children[e.Parent], e.Child) {  // O(E) per edge
    g.children[e.Parent] = append(g.children[e.Parent], e.Child)
}
if !slices.Contains(g.parents[e.Child], e.Parent) {    // O(E) per edge
    g.parents[e.Child] = append(g.parents[e.Child], e.Parent)
}

slices.Contains() performs O(E) linear scans on children and parents slices. The same pattern appears in Eliminate() with nested loops over parents and children.

Complexity Proof

At E=500 edges per node:

Defective: 500 × 250 (avg) × 2 = 250,000 comparisons
Fixed: 500 × 2 O(1) map lookups = 1,000 operations
~250× op reduction. In practice, Loki query planner node fan-out is 1-3, so severity is LOW.

Impact

Grafana Loki is a log aggregation system. The query planner DAG handles query optimization. While practical fan-out is small (making this LOW severity), the fix eliminates unnecessary quadratic scaling for edge-heavy query plans.

The Fix

Add parallel map[NodeType]map[NodeType]struct{} adjacency sets alongside the existing slices:

// After
parentSet    map[NodeType]map[NodeType]struct{}
childrenSet  map[NodeType]map[NodeType]struct{}

if _, exists := g.childrenSet[e.Parent][e.Child]; !exists {
    g.childrenSet[e.Parent][e.Child] = struct{}{}
    g.children[e.Parent] = append(g.children[e.Parent], e.Child)
}

Patch

Fix available: defects/loki/patch/loki-0001-dag-edge-dedup.patch

Single-file patch in pkg/engine/internal/util/dag/dag.go. Slices retained for iteration order, sets added for O(1) membership. ~250× speedup at E=500 (synthetic worst case).

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (grafana/loki).
Assess severity — LOW in practice (small fan-out), eliminates quadratic scaling.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Grafana team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.6 KiB Raw Blame History Unescape Escape