engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/matrix-js-sdk/patch/CLEAN.md
russell@unturf.com 15db2a0269 synapse-0001: sync handler newly_joined_rooms List membership O(J*N); matrix-js-sdk CLEAN 
synapse/handlers/sync.py _get_rooms_changed: newly_joined_rooms is List[str]
checked with `in` inside for-loop over all joined rooms (line 2252).
O(J*N) where J=joined rooms, N=newly joined. Fix: use Set. 99x at J=5000.
2026-03-30 15:23:53 -04:00

997 B
Raw Blame History

matrix-js-sdk — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30 Source: https://github.com/matrix-org/matrix-js-sdk (depth=1)

Scan Coverage

  • src/models/room.ts — room timeline, member list, thread notifications
  • src/models/room-state.ts — member filtering
  • src/sync.ts — sync processing, toDevice event handling
  • src/filter-component.ts — event filter evaluation
  • src/client.ts — client-level operations
  • src/models/event-timeline-set.ts — timeline event dedup
  • src/crypto/ — device tracking, key verification

Findings

All .includes() / .indexOf() calls found are on:

  • Small constant arrays (enum value checks, 2-5 elements)
  • functionalMembers (service member IDs, typically 0-2)
  • excludedIds (small exclusion lists)
  • cancelledKeyVerificationTxns (bounded by single sync response)

No O(N^2) patterns found in hot paths. The codebase correctly uses Map/Set for large collections and only uses Array.includes() on small, bounded arrays.