russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.3 KiB

Raw Blame History

Thunderbird — CWE-407 Disclosure Brief (thunderbird-0005)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Thunderbird's message filter system. FindInReadable() performs substring searches on a growing concatenated header string during ComputeArbitraryHeaders(). Patched.

The Defects

thunderbird-0005 (PATCHED — MEDIUM): mailnews/search/src/nsMsgFilterList.cpp

// In ComputeArbitraryHeaders() — fires during filter initialization:
if (!FindInReadable(arbitraryHeader, m_arbitraryHeaders,
    nsCaseInsensitiveCStringComparator)) {
    m_arbitraryHeaders.Append(' ');
    m_arbitraryHeaders.Append(arbitraryHeader);
}

FindInReadable() performs substring search on a growing concatenated string. This is worse than O(H²) because the substring search itself is O(len), making total cost O(H × sum(len_i)) which approaches O(H² × avg_len).

Complexity Proof

thunderbird-0005: At H=500 arbitrary headers:

Defective: ~125,000 × avg_header_length comparisons
Fixed: ~500 hash insertions
125× overhead at H=500.

Impact

Thunderbird's filter system processes arbitrary headers from all configured message filters. Users with many custom filters (common for mailing list management, spam filtering rules) trigger quadratic accumulation during filter initialization.

The Fix

thunderbird-0005: Track seen headers in nsTHashSet<nsCString>:

// Before — O(H² × avg_len)
FindInReadable(arbitraryHeader, m_arbitraryHeaders, ...)

// After — O(H)
nsTHashSet<nsCString> seenHeaders;
nsAutoCString lowerHeader(arbitraryHeader);
ToLowerCase(lowerHeader);
if (seenHeaders.Insert(lowerHeader, fallible)) { ... }

Patch

Fix available: defects/thunderbird-0005/patch/thunderbird-0005_nsMsgFilterList_ComputeArbitraryHeaders_ON2.patch

Single-file patch in mailnews/search/src/nsMsgFilterList.cpp.

What We Ask

A patch is ready for review.

Confirm receipt and assign a Bugzilla reference (bugzilla.mozilla.org).
Assess severity — fires during filter system initialization.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Thunderbird team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Blame History Unescape Escape