russell@unturf.com 0f13a71cb4 invoiceninja: 3 defects (MOAD-0001/0003/0004); onlyoffice: 1 defect (MOAD-0001); all 5 MOADs scanned

invoiceninja-0001: S3Cleanup in_array O(D*C) across 3 DB shards, fix: array_flip+isset O(D+C), 9499x at D=C=10000
invoiceninja-0002: CheckoutCom webhook logs $request->all() on HMAC mismatch (CWE-312), exposes card fingerprints/BIN
invoiceninja-0003: 20 Mailable build() methods missing App::forgetInstance('translator') before setLocale, Octane locale leak (MOAD-0003)
onlyoffice-0001: Table.js 8x Array.indexOf inside for(curRow) loops O(R*A), fix: new Set+has O(R+A), 375x at R=1000

4/4 unit tests PASS

2026-03-31 20:53:13 -04:00

1.6 KiB

Raw Blame History

OnlyOffice sdkjs — MOAD Scan Summary

Date: 2026-03-31 Target: https://github.com/ONLYOFFICE/sdkjs (depth=1) Language: JavaScript

MOAD-0001 (CWE-407)

DEFECT FOUND — see onlyoffice-0001.patch

word/Editor/Table.js: 8 call sites where row/cell membership arrays are searched with Array.indexOf() inside for(curRow=0..rowCount) loops. O(R*A) per table edit operation. Fix: new Set(array) before the outer loop, Set.has() is O(1).

MOAD-0002 (Intertangle)

CLEAN. The sdkjs client SDK is a browser document editor. Each editor instance (word/cell/slide) is a self-contained module with its own state. No shared mutable global state coupling independent subsystems was found. Global window.Asc.* objects are UI-layer coordinator state, not backend multi-tenant coupling.

MOAD-0003 (Leaked Context)

CLEAN. JavaScript is single-threaded, single-tab execution. No ThreadLocal, ScopedValue, or equivalent per-request identity carrier applies. Each browser tab has its own JS execution context; no cross-request identity leakage is possible in the SDK layer.

MOAD-0004 (CWE-312)

CLEAN. No credentials, API tokens, or authentication headers found in console.log, console.error, or telemetry calls in the word/cell/slide/common modules. Server authentication tokens are handled at the document-server layer (DocumentServer repo), not in sdkjs.

MOAD-0005 (Thundering Herd)

CLEAN. JavaScript executes on a single thread in the browser. Cache get+compute+store race conditions require concurrent threads/goroutines. The sdkjs SDK has no async shared cache that could race. Not applicable.

1.6 KiB Raw Blame History