java-topology/defects/ruffle/scan/MOAD-0002-0005.txt
russell@unturf.com 7786adc4c0 ruffle: 2 CWE-407 defects, MOADs 0002-0005 documented
ruffle-0001: AVM2 optimizer type_aware.rs process_jump() worklist dedup
  Vec<usize>.contains() inside while-loop over basic blocks -> O(B^2).
  Fix: companion HashSet<usize> for O(1) dedup. 249.5x at fanWidth=500.

ruffle-0002: MovieClip goto_commands depth lookup O(F*D^2) -> O(F*D).
  goto_place_object/goto_remove_object use iter().position(|o| o.depth()==d)
  inside frame-scan while-loop. Fix: HashMap<Depth, usize> index alongside
  Vec; swap_remove displacement handled correctly. 51.5x at F=500 D=100.

MOAD-0002 (Intertangle): UpdateContext god-object couples GC/AVM1/AVM2/
  audio/video/renderer/navigator/UI/storage/log/timers/input in one struct.
  Architectural, not a single-patch fix.
MOAD-0003 (Leaked Context): CURRENT_CONTEXT thread_local in web/src/lib.rs
  holds raw *mut UpdateContext<'static> (request-scoped in thread scope).
  Desktop thread_locals CALLSTACK/RENDER_INFO/SWF_INFO carry per-SWF state.
MOAD-0004: CLEAN. No verbatim credential logging found.
MOAD-0005: CLEAN. Arc<Mutex<Player>> used consistently, no unsynchronized
  cache double-check pattern.

2/2 unit tests PASS.
2026-03-31 19:57:30 -04:00

1 line
1.1 KiB
Text

MOAD-0002 (Intertangle): UpdateContext god-object confirmed - couples GC, AVM1, AVM2, audio, video, rendering, networking, UI, storage, logging, timer, input all in one struct (core/src/context.rs). This is structural/architectural - no single-patch fix. MOAD-0003 (Leaked Context): CURRENT_CONTEXT thread_local in web/src/lib.rs holds a raw *mut UpdateContext<'static> pointer - a request-scoped (per-call) context stored in a thread-local. Also desktop/src/main.rs holds CALLSTACK/RENDER_INFO/SWF_INFO per-SWF state in thread_local. Both patterns carry request/session scope in thread scope. MOAD-0004 (Logged Secret): No verbatim credential logging found. Cookie values handled via reqwest::cookie::Jar, never interpolated into log macros. Proxy URL logged on error but contains no credentials. CLEAN. MOAD-0005 (Thundering Herd): Arc<Mutex<Player>> used for player access from async loader contexts. Single-owner pattern - no concurrent get+insert race on shared cache. Audio mixer uses Arc<Mutex<SlotMap>> for sound instances, protected by Mutex throughout. No unsynchronized cache double-check pattern found. CLEAN.