Squid All-5-MOAD Scan Results

Scanned: squid-cache/squid (depth=1, 2026-03-31)

MOAD-0001 (CWE-407): O(N²) list membership

squid-0001 (pre-existing): NotePairs::appendNewOnly O(S*E) — hasPair() scan inside entry loop. Fixed in defects/squid-0001.

squid-0002 (new): HttpHeader::removeConnectionHeaderEntries() O(H*C) — strListIsMember() inside getEntry() loop. Called per response hop in removeHopByHopEntries(). At H=200 headers and C=50 Connection tokens: 4.84x measured speedup. Fixed in defects/squid-0002.

squid-0004 (new): whichPeer() O(PA) nested linear scan over cache peers and their DNS addresses, called on every incoming ICP and HTCP response packet. With P=100 peers and A=4 addresses/peer, each call scans up to 400 entries. Fix: build a std::map<(addr,port), CachePeer> in peerDNSConfigure(), cleared on peer removal. 83x speedup measured at P=100, 1041x at P=1000. Fixed in defects/squid-0004.

MOAD-0002 (Intertangle): god object coupling

SquidConfig is a 571-line god object included in 209 source files across every subsystem: ACL, auth, TLS/SSL, cache, networking, ICAP/eCAP, delay pools, logging, DNS, FTP. Config.* is called 1408 times across the codebase. Every subsystem reads global Config directly with no interface boundary. This is classic Intertangle — changing any field risks ripple effects across all 209 consumers. Not patchable in isolation; requires architectural decomposition into subsystem-scoped config structs with clean interfaces.

Severity: HIGH (structural, long-term technical debt). Not assigned a defect dir — scope is too large for a single patch.

MOAD-0003 (Leaked Context): thread_local request-scoped identity

CLEAN. Squid is a single-threaded event-loop process (one worker per CPU, no shared request state across threads). No thread_local holding request-scoped identity found. The async ACL checklist and callback model handles request context explicitly without thread-local storage.

MOAD-0004 (CWE-312): credentials logged verbatim

squid-0003 (new): Three callsites log plaintext credentials to cache.log:

FtpGateway.cc loginParser(): logs full login=user:password and password= at debug 9
auth/basic/Config.cc decodeCleartext(): logs decoded cleartext (user:pass) at debug 9; logs raw Authorization header at DBG_IMPORTANT (level 1, always logged!) when bad chars detected
auth/basic/UserRequest.cc startHelperLookup(): logs "user:password" at debug 9

The DBG_IMPORTANT site is especially severe — it fires without any debug_options tuning. Fixed in defects/squid-0003.

MOAD-0005 (Thundering Herd): unsynchronized cache

CLEAN. Squid uses an event-driven single-threaded worker model. Cache operations (ipcache, fqdncache, store) are non-concurrent within a worker. The ssl_ctx_cache uses a single-threaded LRU. No get+null+compute+put race condition applies.

2.8 KiB Raw Blame History