java-topology/whitepaper/outreach/rclone-0001.md

rclone — CWE-407 Disclosure Brief (rclone-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

O(T×C) linear scan in bisync graceful shutdown where slices.Contains(toKeep, ...) checks the keep list for every file in the combined listing, producing quadratic overhead during shutdown rollback logic.

The Defect

rclone-0001 (PATCHED — MEDIUM): cmd/bisync/listing.go:695

// Inside combined listing loop during graceful shutdown:
for _, f := range combinedList {
    if !slices.Contains(toKeep, f) && !slices.Contains(toKeep, b.aliases.Alias(f)) && !b.opt.DryRun {
        toRollback = append(toRollback, f)
    }
}

slices.Contains performs O(K) linear scan for each of C combined listing entries. Two calls per entry give O(2×C×K) total.

Complexity Proof

At C=10,000 files and K=5,000 kept files:

• Defective: 10,000 × 5,000 × 2 = 100,000,000 string comparisons
• Fixed: 5,000 map insertions + 10,000 × 2 map lookups = 25,000 operations
• ~4,000× op reduction.

Impact

rclone bisync performs graceful shutdown when interrupted (SIGINT/SIGTERM). Large file sets with thousands of entries compound the quadratic rollback decision logic, delaying the shutdown and potentially causing data loss if the process is killed during the slow rollback computation.

The Fix

Build a map[string]struct{} from toKeep for O(1) lookups:

toKeepSet := make(map[string]struct{})
// ... populate during transfer enumeration ...
_, inKeep := toKeepSet[f]
_, aliasInKeep := toKeepSet[b.aliases.Alias(f)]
if !inKeep && !aliasInKeep && !b.opt.DryRun {
    toRollback = append(toRollback, f)
}

Patch

Fix available: defects/rclone-0001/patch/graceful_shutdown_set.patch

Single-file patch in listing.go.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (rclone/rclone).
2. Assess severity — fires during graceful shutdown with large file sets.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit the rclone team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.