java-topology/defects/jitsi-meet-0002/SCAN-NOTES.md

jitsi-meet-0002 — MOAD-0001 CWE-407

Location

react/features/chat/components/web/MessageContainer.tsx componentDidUpdate(), line 179

Pattern

O(M²): on every React update cycle after a new chat message arrives, this.props.messages.filter(message => !prevProps.messages.includes(message)) scans our full previous message array for each current message. With M messages, our .filter iterates M entries and each .includes() walks up to M entries of prevProps.messages.

const newMessages = this.props.messages.filter(
    message => !prevProps.messages.includes(message)   // O(M) per entry
);
const hasLocalMessage = newMessages.map(message => message.messageType)
    .includes(MESSAGE_TYPE_LOCAL);                     // O(M) second scan

Our secondary scan also maps then includes — two passes when .some() suffices.

Severity

MEDIUM. Jitsi chat rooms in large conferences can accumulate hundreds of messages over a meeting. Each incoming message triggers componentDidUpdate, scanning all prior messages. At M=500: 500×500 = 250,000 comparisons vs 500 with Set. 500x overhead on our hottest render path.

Fix

Build a Set from prevProps.messages once before our filter. Replace .includes() with .has() (O(1)). Replace .map().includes() with .some() — eliminates our intermediate array allocation and second O(M) scan.

Similar pattern (native)

react/features/chat/components/native/SubtitlesMessagesContainer.tsx line 138 uses identical pattern: messages.filter(message => !previousMessages.current.includes(message)). Same fix applies.