russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
37 lines
1.2 KiB
Diff
37 lines
1.2 KiB
Diff
diff --git a/lib/hmr/HotModuleReplacement.runtime.js b/lib/hmr/HotModuleReplacement.runtime.js
|
|
index xxxxxxx..xxxxxxx 100644
|
|
--- a/lib/hmr/HotModuleReplacement.runtime.js
|
|
+++ b/lib/hmr/HotModuleReplacement.runtime.js
|
|
@@ -42,7 +42,8 @@ module.exports = function (parentHot) {
|
|
hot = {
|
|
// ...
|
|
};
|
|
module.parents = currentParents;
|
|
- module.children = [];
|
|
+ // CWE-407 fix: use Set-backed arrays for O(1) dedup in require() hot path.
|
|
+ module.children = [];
|
|
+ module._childrenSet = new Set();
|
|
}
|
|
|
|
// ...
|
|
|
|
@@ -57,10 +57,10 @@ module.exports = function (parentHot) {
|
|
if (me.hot.active) {
|
|
if (installedModules[request]) {
|
|
var parents = installedModules[request].parents;
|
|
- if (parents.indexOf(moduleId) === -1) {
|
|
+ if (!installedModules[request]._parentsSet) installedModules[request]._parentsSet = new Set(parents);
|
|
+ if (!installedModules[request]._parentsSet.has(moduleId)) {
|
|
parents.push(moduleId);
|
|
+ installedModules[request]._parentsSet.add(moduleId);
|
|
}
|
|
} else {
|
|
currentParents = [moduleId];
|
|
currentChildModule = request;
|
|
}
|
|
- if (me.children.indexOf(request) === -1) {
|
|
+ if (!me._childrenSet.has(request)) {
|
|
me.children.push(request);
|
|
+ me._childrenSet.add(request);
|
|
}
|
|
}
|