russell@unturf.com b71284e245 scribus+darktable: 5-MOAD scan; scribus-0004 CWE-407 file-save names.contains O(S^2) 375x; darktable COMPLETE

scribus-0004: scribus{150,170,171}format_save.cpp writes styles via
names.contains() on QList<QString> (from QMap::keys()) inside O(S) loop
— O(S²) per save. Fix: use lists.charStyles().contains() (QMap, O(log N))
directly. 6 defect sites across 3 format variants. 375x at N=1000.

darktable: 5-MOAD scan complete (darktable-0001..0005 + MOAD-0002/0003/0005
CLEAN already committed). No new defects found beyond prior scan.

SCAN-TODO: mark both targets as scanned with summary.

2026-04-03 14:38:26 -04:00

1.9 KiB

Raw Blame History

UNDF: UNDF-2026-000000802

Scribus — 5-MOAD Scan Result

Scanned: 2026-04-01 Clone: https://github.com/scribusproject/scribus (depth=1)

MOAD-0001 (CWE-407): 4 defects — PATCHED (scribus-0001/0002/0003/0004)

scribus-0001: getSortedStyleList / getSortedCharStyleList / getSortedTableStyleList / getSortedCellStyleList — QList<int>::contains() inside O(S) loop → O(S²). Fix: companion QSet<int> for O(1) membership.
scribus-0002: getUsedPatterns — results.contains() inside O(I×R) loop.
scribus-0003: Selection::addItems — m_SelList.contains() inside O(N×M) loop.
scribus-0004: file savers (scribus150/170/171format_save.cpp) — names.contains() on QList<QString> (from QMap::keys()) inside O(S) style-write loop → O(S²) per save. 6 defect sites across 3 format variants. Fix: use lists.charStyles().contains() (QMap, O(log N)) directly instead of materialising a QList for linear scan. 375x at N=1000.

MOAD-0002 (Intertangle): CLEAN

No shared mutable global god object coupling independent subsystems found. ScribusApp and ScribusDoc are well-separated; document state is per-instance.

MOAD-0003 (Leaked Context): CLEAN

No thread_local or QThreadStorage holding request-scoped document identity found. Document context is passed explicitly through function parameters and pointers.

MOAD-0004 (CWE-312): CLEAN

No network credential (password, auth token) logging found. Scribus does not include networking features that authenticate over HTTP/SMTP/LDAP; no logger calls adjacent to authentication credential handling were found.

MOAD-0005 (Thundering Herd): CLEAN

No concurrent cache get+null+compute+put without synchronization found. ScImageCacheManager uses file-level locking (m_writeLockFile) rather than in-memory unsynchronized cache patterns; no QCache or similar structure exposed to concurrent write without lock.

1.9 KiB Raw Blame History Unescape Escape