65 lines
2.7 KiB
Text
65 lines
2.7 KiB
Text
CLEAN — Mindustry (Anuken/Mindustry) — all 5 MOADs scanned 2026-03-31
|
|
|
|
Repository: https://github.com/Anuken/Mindustry
|
|
Version: HEAD (depth=1 clone)
|
|
Stars: 24.6k
|
|
Language: Java
|
|
|
|
## MOAD-0001 (CWE-407): CLEAN
|
|
|
|
Thorough scan of 817 Java source files across core/src/mindustry/.
|
|
|
|
Mindustry uses Arc library data structures throughout. Key findings:
|
|
|
|
- ObjectSet, IntSet, ObjectMap, ObjectIntMap used for all hot-path membership checks
|
|
- PowerGraph.reflow() uses IntSet closedSet for BFS visited tracking
|
|
- PayloadSeq uses ObjectIntMap internally (hash-based)
|
|
- BlockIndexer uses QuadTree for spatial queries, IntSet for position tracking
|
|
- Rules.objectiveFlags is ObjectSet<String>
|
|
- Mods.ModResolutionContext uses ObjectSet for visited, OrderedSet for ordered
|
|
- EntityGroup uses IntMap for entity ID mapping
|
|
|
|
Seq.contains() calls found but all are:
|
|
1. Predicate-based (lambda searching by property, not identity membership)
|
|
2. On small fixed-size collections (weapons, plans, requirements, block flags)
|
|
3. In non-hot paths (UI, connection-time, init, config changes)
|
|
|
|
Administration.bannedIPs/whitelist/subnetBans are Seq<String> with contains()
|
|
calls, but only checked per-connection (not per-tick). Typical N < 100.
|
|
|
|
BlockIndexer.IntSeq.addUnique() for ore quadrants is O(N) but N is bounded
|
|
by quadrant size (20x20 = 400 tiles max per quadrant per ore type).
|
|
|
|
No O(N^2) patterns found in game-tick paths, entity update loops,
|
|
pathfinding, power graph updates, or network sync code.
|
|
|
|
## MOAD-0002 (Intertangle): NOTED but not patchable
|
|
|
|
Vars.java is a classic god object with 40+ public static mutable fields
|
|
(state, world, net, content, mods, renderer, ui, pathfinder, indexer,
|
|
spawner, controlPath, fogControl, logic, control, player, etc.).
|
|
|
|
Every subsystem accesses every other subsystem through these globals.
|
|
This is a deliberate architectural choice common in game engines,
|
|
especially modding-friendly ones. Fixing would require massive
|
|
architectural refactoring, not a patch.
|
|
|
|
## MOAD-0003 (Leaked Context): CLEAN
|
|
|
|
ThreadLocal usage found in:
|
|
- ArcNetProvider: decompression buffers (infrastructure, not request-scoped identity)
|
|
- ModClassLoader.inChild: recursion guard Boolean
|
|
|
|
No request-scoped identity leaked through ThreadLocal.
|
|
|
|
## MOAD-0004 (Logged Secret): CLEAN
|
|
|
|
No secrets (passwords, tokens, API keys) found in Log.info/warn/err calls.
|
|
Network code does not log authentication headers or credentials.
|
|
|
|
## MOAD-0005 (Thundering Herd): CLEAN
|
|
|
|
Game is largely single-threaded (game loop on main thread).
|
|
No cache get+miss+compute+put patterns without synchronization found.
|
|
The synchronized block in ArcNetProvider.discoverServers is a simple
|
|
lock for foundAddresses deduplication, not a thundering herd.
|