russell@unturf.com eb3be81588 cura+prusaslicer: 5-MOAD scan; cura-0002 CWE-407 SettingInheritanceManager List[str] 109x, prusaslicer-0004 CWE-407 FillRectilinear queue 64x

cura-0002: SettingInheritanceManager._settings_with_inheritance_warning is a List[str].
Queried with `in` and mutated with .append()/.remove() on every setting property change.
With S=1000 settings, each _onPropertyChanged call costs O(S). Fix: Set[str] for O(1)
membership. 109x speedup at S=1000.

prusaslicer-0004: chain_monotonic_regions() in FillRectilinear.cpp uses std::find to
search a work queue of MonotonicRegion* on every dequeue. Queue grows to O(R) regions;
10 ants each dequeue all R regions → O(10*R^2) total. Fix: std::vector<bool> in_queue
indexed by region offset for O(1) membership. 64x speedup at R=500.

prusaslicer-scan: MOADs 0002/0003/0004/0005 CLEAN (thread_local is RNG only; no
request-scoped leakage; no full credential logging; slicing is single-threaded).

2026-04-03 14:16:30 -04:00

2.6 KiB

Raw Blame History

PrusaSlicer — MOAD 0002-0005 Scan Notes

Scanned 2026-04-03 against:

https://github.com/prusa3d/PrusaSlicer (depth=1)

MOAD-0001

See prusaslicer-0001, prusaslicer-0002, prusaslicer-0003, prusaslicer-0004 for confirmed defects.

MOAD-0002 Intertangle

PrusaSlicer uses wxGetApp() as a global application accessor (similar to Cura's getInstance()). This is a standard wxWidgets singleton pattern used throughout the GUI layer. No subsystem coupling through shared mutable global state that creates emergent algorithmic behavior was found beyond this pre-existing Qt/wx singleton. No new intertangle defect found. CLEAN.

MOAD-0003 Leaked Context

thread_local usage found in three locations:

src/slic3r/Utils/Http.cpp:367 — thread_local std::mt19937 generator for random boundary strings
src/libslic3r/Feature/FuzzySkin/FuzzySkin.cpp:20-23 — thread_local RNG for fuzzy skin geometry
src/libslic3r/Thread.cpp:222 — thread_local ThreadData s_thread_data holding only a random generator seed and C-locale flag

None of these carry request-scoped identity or session state. All are appropriate use of thread_local for per-thread RNG initialization. No MOAD-0003 defect found. CLEAN.

MOAD-0004 CWE-312 Logged Secret

src/slic3r/GUI/UserAccountSession.cpp lines 268, 290 log access tokens as debug:

BOOST_LOG_TRIVIAL(debug) << __FUNCTION__ <<" access_token: " << access_token.substr(0,5) << "..." << access_token.substr(access_token.size()-5);

This logs first 5 + last 5 chars of our access token. This is debug-level only and partially redacted. The commented-out lines (272-273) would have logged full tokens — those were already removed. Our active code only logs a 10-char fragment.

src/slic3r/GUI/WebViewPanel.cpp:678 has console.log('Updated Auth token', window.__access_token) but that branch is behind #if AUTH_VIA_FETCH_OVERRIDE which is #define AUTH_VIA_FETCH_OVERRIDE 0 at line 31 — disabled in production.

The non-AUTH_VIA_FETCH_OVERRIDE path logs token.substring(token.length - 8) (last 8 chars only).

Verdict: BORDERLINE but not a new defect — partial token fragments in debug logs are intentional developer aids, not credential exposure. No new MOAD-0004 defect created. Noted for awareness.

MOAD-0005 Thundering Herd

PrusaSlicer slicing is single-threaded (one Print object per job). The TBB parallel_for usage in tree support, infill, and layer processing all uses per-call work distribution with no shared mutable cache that requires synchronization. No cache.get() → null → compute → set pattern without synchronization found. CLEAN.

2.6 KiB Raw Blame History