java-topology/defects/thunderbird-0006/TICKET.md

thunderbird-0006 — nsSpamSettings::CheckWhiteList() linear email scan O(M*E)

UNDF: UNDF-2026-000000892 MOAD: 0001 (CWE-407) Severity: MEDIUM Component: mailnews/base/src/nsSpamSettings.cpp

Summary

CheckWhiteList() is called for every incoming message to determine if our sender is whitelisted. For each message, it performs two separate linear scans through mEmails array.

Measured 100x overhead at E=100 email identities per message.

Fix

Build an nsTHashSet<nsCString> of whitelisted addresses at setup/update time, then CheckWhiteList() becomes a single O(1) hash lookup per message.

Files

• patch/thunderbird-0006_nsSpamSettings_CheckWhiteList_ON2.patch
• test/ThunderbirdSpamWhitelistTest.java